Regarding the Exams
-
Must present 2 forms of ID which include a signature
Arrive early so you can review your materials
The exams are 90 questions in 90 minutes
The most difficult questions are presented first, it is wise to mark them and
complete them last
You will not be permitted to bring anything into the exam
Read the questions carefully as they are often misleading, CompTIA is testing
your understanding of their methodology more than general apprehension
All unanswered questions will be marked incorrect
Many questions will have multiple answers, be vigilant for any instructional text
For task based questions, review them immediately to ensure you’ve completed
all parts
Introductory Practice Exam Core 1
1 C (C) / 2 D (A) / 3 AB (AB) / 4 A (A) / 5 C (C) / 6 CDE (CD) / 7 A (A) / 8 A (D) /
9 CD (CD) / 10 D (D) / 11 B (C) / 12 B (A) / 13 A (C) / 14 B (C) / 15 D (A) / 16 BD (AB) /
17 A (A) / 18 D (D) / 19 AD (CD) / 20 B (B) / 21 A (B) / 22 BD (AC) / 23 C (C) / 24 D (A)
25 A (D) / 26 A (A) / 27 D (B) / 28 D (D) / 29 D (C) / 30 D (D) / 31 C (D) / 32 A (B) /
33 C (C) / 34 B (C) / 35 D (B) / 36 BC (BC)
Introductory Practice Exam Core 2
1 B (B) / 2 D (D) / 3 B (B) / 4 C (C) / 5 C (C) / 6 D (D) / 7 B (D) / 8 C (D) / 9 C (C) / 10 A
(D) / 11 C (C) / 12 D (C) / 13 D (B) / 14 D (D) / 15 A (A) / 16 B (B) / 17 B (C) /
18 B
(B) / 19 D (B) / 20 B (A) / 21 A (B) / 22 B (B) / 23 D (C) / 24 C (C) / 25 D (B) /
26 C
(A) / 27 C (D) / 28 C (C) / 29 C (C) / 30 B (C) / 31 A (B) / 32 B (A) / 33 A (C) /
34 B
(B) / 35 D (D) / 36 B (B) / 37 B (D) / 38 BD (BD) / 39 D (D) / 40 B (B) / 41 D (B) / 42 C
(C) / 43 A (D) / 44 C (C) / 45 C (C) / 46 C (C) / 47 B (A) / 48 A (D) / 49 C (C) /
50 A
(A)
Glossary:
ARM (Advanced RISC Machine) ATX (Advanced Technology eXtended) BIOS (Basic Input/Output System) Channel CISC (Complex Instruction Set Computer) Core CPU (Central Processing Unit) DDR (Double Data Rate) DIMM (Dual Inline Memory Module) ECC (Error Correction Code) Headers HSM (Hardware Security Module) ITX (Information Technology eXtended) M.2 Multisocket Multithreading PCI (Peripheral Component Interconnect) RAM (Random Access Memory) RISC (Reduced Instruction Set Computer) SAN (Storage Area Network) SATA (Serial Advanced Technology Attachment) SCSI (Small Computer System Interface) SODIMM (Small Outline Dual Inline Memory Module) TPM (Trusted Platform Module) UEFI (Unified Extensible Firmware Interface) USB (Universal Serial Bus) Virtualization VRAM (Virtual Random Access Memory) x64/x86 -
Core 1 Notes
Chapter 1 - Motherboards, Processors, and Memory
Motherboards
-
-
“The Big Three” of computer parts are the MOBO, CPU, and RAM
The MOBO (aka System Board or Main Board) is the “spine” of the computer as
it connects all the other components
The MOBO is a PCB (Printed Circuit Board)
MOBO must match form factor, and chipset as well as support all needed
components
ATX boards have the CPU and RAM slots at right angles to the expansion cards,
this configuration aligns those components with the PSU fan exhaust providing
cooling
Standard ATX boards measure 12” x 9.6” (305mm x 244mm)
ITX boards are lower power and smaller form factor
ITX is a family of form factors: Mini, Nano, Pico, and Mobile
Mini-ITX is compatible with ATX cases
Bus Architecture
-
-
Busses are signal pathways that send data between components
Serial Busses send data 1 bit at a time, Parallel Busses send 1 byte through separate
lines
Modern PCs use serial transmissions since technology has improved the speed
Serial communications include SATA, USB, IEEE 1394/FireWire, and PCIe
The term bus is also used in any parallel or bit-serial wiring implementation where
multiple devices can be attached at the same time in parallel or in series (daisy-chained).
E.g. SCSI (Small Computer System Interface), USB, and Ethernet
Busses will often need to synchronize speeds to function properly
Chipsets
-
A chipset is a collection of chips or circuits that perform interface and peripheral
functions for the processor
The chipset dictates how a MOBO will communicate with its installed components
Chipset naming conventions are decided by the manufacturer and can be easily
referenced
-
Chipsets are made up of at least one integrated chip, sometimes these chips are
obscured by cooling systems
- Chipsets can be functionally categorized as Northbridge and Southbridge, however AMD
and Intel have integrated these features into their CPUs rather than the MOBO
- Northbridge
- The Northbridge set performs the management of high-speed peripheral
communications such as video and CPU to RAM communications
- CPU to RAM and PCIe communications occur over the FSB (Front-Side Bus)
- The Northbridge contains the clock signal that synchronizes components
- The BSB (Back-Side Bus) connects the CPU to external cache memory and may
not be present
- If there is no BSB, the cache is placed on the FSB
- The Northbridge controls the Southbridge
- Southbridge
- The Southbridge set performs the management of slower communications to
peripherals such as USB, SATA, PATA, parallel ports, serial ports, etc.
- The Southbridge does not need to keep up with the clock speed
- Any component that would impose a bottleneck to the clock speed should be
implemented on the Northbridge
Expansion Slots
-
Expansion slots are typically 1-6” long and ½” wide
PCI slots are outdated and have been mostly surpassed by PCIe slots
PCI busses operate at 33 or 66 MHz over a 32-bit channel
PCI busses have data rates of 133 or 266 MBps
PCI operates at 3.3 or 5 V
5 V slot notches are oriented towards the front of the MOBO, 3.3 V to the back
Mobile Devices (Wearables, Phones, Tablets, and
Laptops)
Migrating Drives
In-Place Clone - Used when both drives can be simultaneously accessed by the computer
Install cloning software > Shutdown/Discharge the computer > Connect the new device >
Run the cloning software (be mindful of selecting the correct source and output) >
Shutdown/Discharge the computer > Remove the old device > Install the new device (if initially
connected externally) > Reboot and test
Backup and Restore - Used when only one drive can be accessed at a given time
Backup the old device > Obtain/Create Boot Media (via flash drive) >
Shutdown/Discharge the computer > Remove the old device > Install the new device > Boot
system from Boot Media > Restore system from created backup > Reboot and test
Displays
LCD (Liquid Crystal Display) uses an intermediate state of matter in which light-interacting
crystals are rotated via electric signal allowing and disallowing the transmission of light. LCDs
require backlighting to function which is commonly supplied by CCFL (Cold Cathode
Fluorescent Light) or LED (Light Emitting Diode). Color is provided via transparent color filters
which create a Red, Green, and Blue subpixel for each display pixel.
An LED display is still an LCD display, the denotation of LED only means that its backlight is
LED rather than CCFL.
Twisted Nematic (TN) displays are quite inexpensive but offer the worst color quality and
relatively poor viewing angles. TN Displays do have high response times offering minimal
latency and high refresh rates.
In-Plane Switching (IPS) displays are also inexpensive but more than TN displays. IPS features
wider viewing angles, and response and refresh rates that are adequate for most purposes. IPS
does offer the best color quality.
Vertical Alignment (VA) displays are a good intermediate between the viewing angles and color
quality of IPS and the speed of TN. Highest contrast ratio, but slower than TN.
Quantum Light-Emitting Diode (QLED) displays are also LCD, but use quantum excitation in
nanoparticles to preface the light emissions before they reach the liquid crystals.
Organic Light Emitting Diode (OLED) displays emit light when an electric current is passed
through an organic (carbon containing) semiconductor. OLED are relatively new, and do not
require backlighting. OLED can display true blacks as there is no backlighting and their color
quality is more accurate since the colored light is emitted directly rather than using color filters.
OLED displays can bend, and are more common in smaller devices such as phones, wearables,
and tablets.
Color Depth - Number of bits per pixel available for providing color information to a display. This
value indicates the bits-per-pixel for each of the three RGB colors. E.g. Total # of possible
colors = (2n)3 : where n is color depth per pixel and 3 represents RGB.
8-bit color ~ 16.78 Million colors
10-bit color ~ 1.07 Billion colors
Color Gamut - The range of visible colors (usually expressed as a %) that can be displayed with
a given combination of display driver and monitor. Higher is better. These are measured within
color standards (sRGB, Adobe RGB, NTSC, DCI-P3, etc.) so always compare monitors within
the same standard.
A Chromaticity diagram is a graphical representation of the color gamut. The colored space is
the human color visibility spectrum, the inscribed regions are the representation areas of
different color standards.
LCD displays require an inverter to convert DC to AC power, whereas OLED or LED displays
run on DC.
Network Connectivity
International Mobile Equipment Identity (IMEI) - A 15 or 17 digit cell phone identifier that enables
a provider to blacklist a stolen device.
International Mobile Subscriber Identity (IMSI) - A 15 digit (or less) cellular network identifier.
Identifies the user on any and all cellular networks; stored on the SIM card.
Global System for Mobiles (GSM) - More common outside US, used by AT&T and T-Mobile in
US
Code Division Multiple Access (CDMA) - More common inside US, used by Verizon and Sprint
GSM and CDMA are common in 2G and 3G networks but are being phased out in favor of 4G,
LTE, and 5G networks
US carriers shutdown their GSM and CDMA networks in 2022 in favor of >4G networks
Wifi connectivity on mobile devices usually sourced by a mini-PCIe card with integrated antenna
Business and home networks provide a Wireless Access Point (WAP) which may be a single
device or part of a router
Modern devices support WiFi 6 (802.11ax) with up to 14Gbps over 2.4 or 5GHz bands
Bluetooth devices operate over shorter distances and create a (Wireless) Personal Area
Network (PAN/WPAN)
Class 3 - <1m, Class 2 (Most Common) - <10m, Class 1 - <100m
App Support and Synchronization
Post Office Protocol (POP3) - User downloads emails, marks them for deletion on server, POP3
is designed for 1 client on 1 device
Internet Message Access Protocol (IMAP) - Emails are kept on the server until the user deletes
them, IMAP is designed for any client on any device
Mobile clients in the Microsoft environment use Messaging Application Program Interface
(MAPI) rather than IMAP or POP3. MAPI is useful for contacts, calendars, and synchronization
Simple Mail Transport Protocol (SMTP) is the basic system for outgoing mail services
Secure Sockets Layer (SSL) encrypts traffic between the client and server, can be
enabled/disabled for incoming, outgoing mail, or both
SSL usually operates on port 995 or 993 for incoming mail, 465 for outgoing
SSL is more secure than SMTP, but it is not end-to-end encryption, meaning there is no
guarantee of encryption when it arrives at its recipient server
Secure Multipurpose Internet Mail Extensions (S/MIME) is a more robust encryption protocol
that guarantees encryption, facilitates authentication via digital signatures, and ensures
message integrity (meaning the message received is validated to match the message sent)
S/MIME does offer end-to-end security, however this encryption prevents server side scanning
for malware and spam as the server does not have the ability to decrypt traffic
S/MIME requires a certificate system, a Public Key Infrastructure (PKI)
Single Sign-On (SSO) is a system in which the local device is trusted and therefore the user
only needs to sign into a computer with their microsoft account to gain automatic access to all
microsoft suite applications
SSO should be accompanied by MFA for security
Mobile Device Management (MDM) - A utility for managing multiple mobile devices from a single
device, facilitates the monitoring, securing, and administration of connected (typically
corporate-owned) devices and typically across multiple platforms
Mobile Application Management (MAM) - Focused on protecting corporate data and configuring
business apps. MAM is less intrusive than MDM and is better for BYOD. MAM is targeted to
users rather than devices
MDM requires enrollment, MAM does not
Networking
Networking Configuration Concepts
Internet Protocol (IP) - The principal set of digital message formats and rules for exchanging
messages between computers across a single network or a series of interconnected networks
IP Address - Logical numeric address assigned to an internet or network connected device
IPv4 - 32 bit address therefore 4.2 billion addresses, current address pool is exhausted
The first 3 numbers of an IPv4 address represent the network ID, the last number represent the
host ID
Subnet Mask - Used by TCP to determine which network a subnetwork is on, the subnet mask
decodes the IP address
IP address are divided into 5 classes A-E, only ABC are common
Class A - 1-126 in the first octet / Subnet Mask 255.0.0.0 / Example 10.52.36.11 / CIDR /8
Class B - 128-191 first octet / Subnet Mask 255.255.0.0 / Example 172.16.52.63 / CIDR /16
Class C - 192-223 first octet / Subnet Mask 255.255.255.0 / Example 192.168.123.132 / CIDR
/24
Class D - Multicast IP addresses
Class E - Experimental IP addresses
CIDR (Classless Inter-Domain Routing) - Alternative to class system
IPv4 has private addresses in 16, 20, and 24 bit blocks that can be used to supplement the
scarce public addresses
Private addresses are remapped (translated) within a router through Network Address
Translation (NAT) to an available public IP address that can connect to the internet
The private address system allows public addresses to function for all devices within a
household
IPv6 - 128 bit address, creating plenty of public addresses, IPv6 uses hexadecimal addressing
rather than decimal, and IPv6 is fully compatible with IPv4, addresses are 8 16-bit blocks
Example IPv6 address:
2001:0000:3238:DFE1:0063:0000:0000:FEFB
Binary Conversion - 0010000000000001 0000000000000000 0011001000111000
1101111111100001 0000000001100011 0000000000000000 0000000000000000
1111111011111011
Rules to shorten addresses:
Discard the leading 0s
2001:0000:3238:DFE1:63:0000:0000:FEF
If 2 or more consecutive blocks show only zeroes, replace with ::
2001:0000:3238:DFE1:63::FEF
Then replace blocks of 0 with a single 0
2001:0:3238:DFE1:63::FEF
Dynamic Host Configuration Protocol (DHCP) - DHCP servers assigns IP addresses
temporarily, recurring devices will eventually be reserved addresses but eventually all addresses
will change, uses UDP 67/68
Automatic Private IP Addressing (APIPA) - When a DHCP server is unavailable, the device will
automatically assign itself an APIPA address also known as a Link-Local address, this allows
the device to communicate on the local network but cannot access the internet
Domain Name System (DNS) - Translates the domain name into an IP address, uses TCP/UDP
53
Gateway - A device located at the boundary of a network, the router is usually the gateway at
home
Two most common network protocols are TCP and UDP, facilitates the transmission of
information between devices
Both TCP and UDP are complements to the IP
Transmission Control Protocol (TCP) - Connection-oriented protocol, requires a connection to
be established before any data can be sent, after the data is sent the connection is terminated.
TCP is the most reliable with error detection and systems to guarantee data integrity
User Datagram Protocol (UDP) - Connectionless protocol, data is continuously sent to the
recipient with only basic error checking and no confirmation, UDP is best for real-time
communications or online gaming
TCP can retransmit lost packets, while UDP cannot
UDP is faster than TCP
Network Port - A process-specific or application-specific software construct serving as a
communication endpoint, which is used by the Transport Layer protocols of IP (TCP and UDP)
File Transfer Protocol (FTP) - One of the most common protocols, moves files from one system
or another, uses TCP 20/21
Secure Shell (SSH) - Most commonly used to manage network devices at the command level,
uses TCP 22
Telnet - Similar use case to SSH but is not a secured connection and is therefore not
recommended over public networks, uses TCP 23
Simple Mail Transfer Protocol (SMTP) - Popular protocol for email between mail servers and
from end-users to email systems (e.g. Outlook), uses TCP 25
Hypertext Transfer Protocol (HTTP) - Used to display webpages, HTTP is unsecured, uses TCP
80
Hypertext Transfer Protocol Secure (HTTPS) - A secure version of HTTP, uses TCP 443
Post Office Protocol v3 (POP3) - Used to retrieve email from a server, uses TCP 110
Internet Message Access Protocol (IMAP) - More versatile email retrieval protocol (see POP3),
uses TCP 143
Simple Network Management Protocol (SNMP) - Collects and organizes information about
devices connected to the network, uses TCP/UDP 161/162, most commonly configured as UDP
but can use TCP
NetBIOS over TCIP/IP (NetBT) - Central protocol for interconnection for windows devices, uses
TCP/UDP 137/138/139
Lightweight Directory Access Protocol (LDAP) - Used for accessing and maintaining distributed
directory information, uses TCP/UDP 389
Server Message Block (SMB) - Foundation of windows networking, also known as Common
Internet File System (CIFS), interconnectable but somewhat distinct, uses TCP 445
Remote Desktop Protocol (RDP) - Used for remote viewing within network, uses TCP 3389
Networking Hardware
Hub - Early device to connect networks together, transmits any signal going into all data
interfaces on the device, the hub operates at half-duplex meaning it only allows one device to
communicate at a time, less efficient as traffic increases across the hub, hubs can only
communicate at 10 or 100Mb/s
Switch - Modern replacement for a hub, can analyze where the information needs to go and
direct the traffic to the correct recipient through a hardware component Application Specific
Integrated Circuit (ASIC), switches can vary in size depending on the intended use
Switches can be unmanaged, meaning they allow all devices on a network to communicate, or
managed which allows management of network ports and speeds
Router - Device the facilitates communications between subnets, makes forwarding decisions
on the destination IP based on an internal routing table, routers can connect Local Area
Networks (LAN) to Wide Area Networks (WAN, Internet), sometimes routing is enabled within a
switch and is called a layer/level 3 switch
Access Point - A device that bridges the wireless connection to a wired connection (e.g. our
home router), think of it as the wi-fi box, access points also make routing decisions
Cable/DSL Modem - (Modem stands for Modulator/Demodulator) Converts the analog signal
from a phone line into a digital signal, for cable/DSL connections
Optical Network Terminal (ONT) - A modem for fiber technology, converts analog light signal to
digital signal
Firewall - Can be hardware or software, filters traffic by port number or application to block
bad/unnecessary traffic
Network Interface Card/Networking Card (NIC) - Connects device to networks
Patch Panel - Used for large-scale enterprise networks, end-point for management of many
ethernet cables
Power over Ethernet (PoE) - A feature that allows transmission of electrical power over ethernet,
common in network enabled security cameras, or VoIP telephones, it is usually provided by the
switch but can also be provided by a PoE injector placed between the switch and the device
IEEE 802.3af - PoE standard transmission - 12.95W - Cameras, VoIP phones
IEEE 802.3at - PoE+ - 25.5W - PTZ cameras, alarm systems
IEEE 802.3bt - PoE++ (Type 3) - 51W - Video conferencing, advanced access points
IEEE 802.3bt - PoE++ (Type 4) - 71.3W - Laptops, screens
Software-defined Networking (SDN) - A newer approach to managing network hardware, uses
software-based controllers and APIs to communicate with connected devices, allows total
control of the network from a single device, can control multiple networks from the same point
ISP > Modem/ONT > Router > PoE Switch > Cameras
V > Network Card
Network and Internet Connection
Personal Area Network (PAN) - Occupies very small spaces such as individual rooms,
wirelessly can be Bluetooth, wired connections would include devices and peripherals. You may
not consider these networks, but by definition they are.
Local Area Network (LAN) - Occupies a building, useful for groups wanting to share resources
and information among themselves, but not the wider world. LAN can be composed of many
devices both wired and wireless. If a LAN consists of entirely wireless connections it is called a
WLAN.
Virtual Local Area Network (VLAN) - A system that allows partitioning of LAN into subgroups
based on needs and functionality, allows for easier system management and creating specific
application or security protocols depending on the partition.
Metropolitan Area Network (MAN) - Connects multiple LANs together across multiple buildings
or an entire municipality, e.g. college campuses or municipal server networks.
Wide Area Network (WAN) - WAN can be any size larger than LAN, MAN can be WAN. WAN
can span from multiple office buildings to multiple countries. The Internet is the most popular
WAN.
Storage Area Network (SAN) - Internal server that creates a dedicated high-speed network for
sharing access between storage devices in an organization. SANs can be accessed by
connected devices as though the storage devices were internal to the user’s computer.
Digital Subscriber Lines (DSL) - Uses existing phone lines, should be called ADSL (Asymmetric)
because download speeds are significantly faster than upload speeds. In theory, 100Mbps,
most commonly ~7Mbps. Internet speed is inversely proportional to the distance from the ISP
or nearest repeater.
Cable - Uses existing cable coax connections. Uses the Data Over Cable Service Interface
Specification (DOCSIS) standard. Speeds are offered in packages ranging from 10Mbps to
940Mbps, but commonly are capped at 300-400Mbps within larger municipalities. Speed is
determined by the ISP.
Fiber - Uses optical fiber cables to further increase speeds to 1-10Gbps.
Satellite - Modem is directly connected to a satellite, most commonly used in remote sites or
extremely rural areas without cable infrastructure. High cost, low speeds, high latency.
Cellular - Connects via the cellular network, with speeds up to 1Gbps.
Wireless Internet Service Providers (WISP) - Popular in rural regions without cable
infrastructure, sets up towers similar to cell towers that have a fiber optic connection, homes or
businesses use receivers to connect to the tower. Faster speeds and lower latencies than
satellites.
Protocols for Wireless Networking
All devices with the Wi-Fi trademark adhere to an IEEE standard
- Institute of Electrical and Electronics Engineers
802.11a - First wireless standard (1999), operated at 5GHz, up to 54 Mbps, but with a low range
and sensitivity to physical barriers between the access point and device. Not common
anymore.
802.11b - Sister standard to a, but at 2.4GHz and slower at 11Mbps, much greater range,
2.4GHz range can experience interference from devices on or near the same frequency, e.g.
microwaves, baby monitors, cordless telephones
802.11g - 2003 upgrade to b, still operating at 2.4GHz but with 54Mbps. Backwards compatible
with b
802.11n - 2009 upgrade, worked on both 2.4 and 5GHz bands, offered 600Mbps. Introduced
Multiple-Input Multiple-Output antennas (MIMO), allowing multiple antennas in access points to
achieve those higher speeds, MIMO is those routers with multiple antennas
802.11ac - Wi-Fi 5, introduced in 2014 only operates at 5GHz, using all MIMO streams it can
achieve up to 7Gbps
802.11ax - Wi-Fi 6, introduced in 2019 operates on both 2.4 and 5GHz bands, 14Gbps
802.11ax-2021 - Wi-Fi 6E, approved by IEEE in 2021, not available in all countries yet, uses
6GHz band, is only backwards compatible with 802.11ax
Wireless communications are regulated by the government (FCC in US), there are broadly 2
types of frequencies: licensed and unlicensed. Licensed frequencies require the user to buy a
license to transmit within that frequency, offering greater reliability and bandwidth. Unlicensed
frequencies can be used by anyone to transmit data but are still regulated. Wi-Fi frequencies
are unregulated hence why you don’t need to apply for a license, the regulations are usually
hardcoded into a wireless router, e.g. signal power.
Example FCC regulation - Wi-Fi 6E (802.11ax-2021) routers can transmit with up to 36 dBm
(decibels per milliwatt) of equivalent isotropic radiated power (EIRP), this is the total radiated
power from the transmitter antenna multiplied by the numerical directivity of the antenna
2.4GHz refers to any frequency between 2.4-2.5GHz
5GHz = 5.1-5.8GHz
5.9GHz is “the safety band” and is partially reserved for transportation communications
for autonomous vehicles and emergency vehicles communicating with traffic systems
2.4GHz includes 14 channels for signal, only 11 are used in the US
Each channel is 20-22MHz wide with 16-22MHz of separation, most routers will automatically
assign which channels are used but this can be configured manually
On 2.4GHz only channels 1, 6, and 11 are non-overlapping channels
5GHz allows 24 20MHz non-overlapping channels with configurable wide channels that are 40,
80, or 160 MHz wide (160 may be referred to as super-wide), wider bandwidth allows for wider
bandwidth
6GHz allows 7 160MHz non-overlapping channels
Bluetooth is a wireless standard for shorter PAN utility, but with modern advances has a
theoretical maximum range of 800 feet with Bluetooth 5.0
Operates at 2.4GHz, popularity is primarily due to the substantially reduced power consumption
especially compared to Wi-Fi, there is even an extra low power variant called Bluetooth Low
Energy (BLE)
Bluetooth has significantly lower speeds at 1-3Mbps, enough for wireless peripherals but
insufficient for internet traffic
Near Field Communication (NFC) allows for wireless communication between compatible
devices at very low range (<10cm), it can be passive (bus card, tap to pay) or active (phone,
card reader), the active device is powered and activates the passive device to interact with it
Radio-Frequency Identification (RFID) similar purpose to a barcode, UPC, or QR code but
without the need for direct line-of-sight, commonly used to track items through systems
Networked Hosts and Services
Web servers deliver web based content, e.g. wikipedia.org, web servers can be public
(accessible from outside via the internet) or private (organizational intranets). Web servers use
many different technologies but common ones include Apache or Microsoft’s Internet
Information Services (IIS)
File servers create a central location to store documents and files, enterprise business often
have a file share server
Print servers manage and distribute print jobs among printers connected to the server, it allows
users to print across multiple networked printers and gives administrators visibility and
management capabilities
Mail/Email servers manage email services within an organization, Microsoft’s Exchange Server
is a popular option
Syslog servers consolidate logs from multiple sources in a single location, e.g. routers, firewalls,
web servers
Authorization, Authentication, and Accounting (AAA) servers handle user authentication and
permissions, authorizes users to access certain resources if they have been approved to by the
owner, and audits/logs activity on the server for review if necessary. Microsoft’s Active Directory
is a popular service
Domain Name System (DNS) servers enable the DNS for users
Dynamic Host Configuration Protocol (DHCP) servers enable the DHCP for users
Load Balancers distribute traffic across multiple resources to balance the load on a server, they
are very popular within web servers and web based applications, they also provide some fault
tolerance since when a web server is down the load balancer will stop forwarding traffic to it
Proxy servers handle external requests made by users on a network, it sits between the user
and the server offering different levels of security such as a firewall or web filtering, privacy by
changing IP addresses, and functionality such as blocking certain websites or caching web
content
Spam Gateways check email and block spam as well as offer some antivirus capabilities
Unified Threat Management (UTM) combines multiple security features into a single hardware
appliance, e.g. routing, firewall, VPN, Anti-Spam, DDOS protection, etc.
Embedded systems are hyper-specialized computer systems designed for a singular purpose,
e.g. monitoring valves
Supervisory Control and Data Acquisition System (SCADA) is a very popular embedded system
that are used in large scale industrial applications for monitoring sensors, valves, motors,
pumps, etc. SCADA was not initially designed for network capabilities so there is often
dedicated hardware to manage those devices, SCADA is relatively old so security is not robust
Internet of Things (IoT) enables network connectivity to normally non-internet connected
devices
Networking Troubleshooting Tools
Crimpers are used to create ethernet connections by allowing you to cut cables to exact lengths
and press connectors onto the cable jacket, allows you to make custom ethernet cables
Cable/Wire Strippers are used to remove the cable jackets
Tone generator and probes are used to find two ends of a cable, connect one end to a generator
and take the probe to where you think the end of the cable is and you will hear the tone, the
probe does not need to be touching the cable
Cable testers are used to validate all the pins on a network cable are properly connected,
advanced testers can also measure signal loss and interference
Loopback plugs are used to troubleshoot physical interfaces, it will make the computer think it is
being connected to a network, but will instead retransmit information back to the computer, e.g.
it allows you to see if what the computer sends is what is being received
Punchdown tools are used to work with patch panels or punchdown blocks, it is used to
physically connect wires to their connectors, it connects the wire and trims additional wire for
better management
Network Tap (Test Access Point/Terminal Access Point) is used to connect directly to the cabling
infrastructure to split or copy packets for analysis, security, and network management
Wi-Fi Analyzers are used to debug wireless networks, can be hardware or software, they show
the signal strength and detect interference, helps to troubleshoot and optimize the wireless
network
Example Network Configuration Module
You just bought a new house and you need to setup the network, it has a home office, and we
need to optimize the network
Getting Internet to the House
Verify service availability from multiple ISPs, choose an available ISP and package, the initial
package should be plug-and-play, install the modem and router
Configuring Access Point Settings
Find the IP address of the router, usually provided by the ISP or router manufacturer, navigate
to the access portal and sign in, change the default administrator password, configuring the
DNS, DHCP, and other protocol settings is done within the advanced settings area, configure
the DHCP settings for IP range and subnet, configure the public DNS settings, configure your
WAP settings including bands, channels, signal strength, security types
Configuring End Devices
Connect wireless devices, or connect wired devices to the routers, configure a static IP if
desired, if setting up a static IP the gateway and preferred DNS should be your router, and
ensure that your address is outside your router’s DHCP range
Optimizing the Network
Install Wi-Fi extenders or mesh systems as needed to ensure optimal signal strength throughout
the house, configure Quality of Service (QoS) settings on your router, this allows you to set
different priorities for network traffic by Mac address, IP address, port number, or application,
e.g. setting the home office to take priority over streaming devices
Advanced DNS Options
Not common for home but for small business or enterprise networks, allows you to host
applications like websites from your network, DNS records can be configured to host servers,
direct email, and other functionalities.
The A record is an IPv4 record that maps a name to an address for a website or load balancer
service
The AAAA record serves the same purpose for IPv6
Mail Exchanger (MX) records direct mail to a mail server, it will point to a domain name instead
of an IP address, multiple MX records with different priorities in case a mail server goes down
providing redundancy
Text (TXT) records were originally used for human-readable notes but are now used for many
purposes, such as domain ownership verification, and spam prevention
Spam prevention through TXT allows detection of spoofed domains, SPF records list all the
servers that are authorized to send email messages from a domain, DKIM signs each email
using a public-private key pair, Domain-Based Message Authentication Reporting and
Conformance (DMARC) authenticates email by aligning SPF and DKIM and has instructions for
other servers on what to do with emails attempting to spoof your domain
Hardware
Internal Hardware Components
Basic Input Output System (BIOS) - Firmware computer instructions embedded on the PCB that
allow performing a Power-On Self Test (POST), allowing the computer to check what
components are accessible and installed, vendors will periodically update their BIOS
Complementary Metal-oxide Semiconductor (CMOS) - The settings available at the BIOS level,
the user’s configuration settings for their BIOS
Unified Extensible Firmware Interface (UEFI) - Similar but more recent BIOS upgrade, performs
the same tasks as the BIOS but supersedes it, includes clickable settings, GPT disk boot,
secure boot
Trusted Platform Module (TPM) - A firmware cryptographic solution that generates secure
hashes for boot integrity, TPM also encrypts data at rest and stores the hashing keys, TPM is
available on motherboards or via PCI expansions
BitLocker - A microsoft feature that encrypts certain disk partitions
Hardware Security Module (HSM) - External cryptographic component that is more versatile
than TPM, it performs key generation, key storage, encryption and decryption, hashing, and
SSL / TLS offload to secure network communications
Cables, Interface Connectors, and Power
Integrated Drive Electronics (IDE) - Older standard that transmits using parallel, sometimes
called PATA, 40 or 80 wire ribbon cable that connects to the motherboard.
Small Computer System Interface (SCSI) - Traditionally a parallel standard, but there are serial
variants in the world, internal and external variants for in/out-of-case connections
Twisted Pair (TP) - Network cables that twist to avoid interference
Coax - Singular wire cable
T568A Wiring Standard - Is used for crossover (2-way) cables
T568B Wiring Standard - Is used for straight-through cables
Cat 5 - 100Mbps
Cat 5e - 1Gbps
Cat 6 - 10Gbps / 10m or 5Gbps / 100m
Cat 6a - 10 Gbps / 100m
Storage and Memory
Redundant Array of Independent Disks (RAID) - A group of physical disks working together,
provides increased performance and fault tolerance, disks can be hot swapped, RAID
controllers are designated pieces of hardware or software to configure and use RAID disks
RAID 0 - Striped Volume, at least 2 disks, all data is written across both disks to increase the
performance, offers no fault tolerance
RAID 1 - Mirrored Volume, at least 2 disks, all data is copied on disks to create redundancy but
no increased performance
RAID 5 - Striping with Distributed Parity, at least 3 disks, data is striped across disks with
redundancy striping distributed across different disks, allowing rebuilding of any failed disks and
increases performance
RAID 10 - RAID 1 + RAID 0, at least 4 disks, combines mirroring and striping
RAID 50 - RAID 5 + RAID 0, at least 6 disks, combines mirroring and striping with distributed
parity
Network Attached Storage (NAS) - Network storage accessible over a standard IP network,
allows backup to cloud
iSCSI - Deeper storage than NAS, uses TCP 3260, embed I/O commands in IP packets
Cloud Storage - Using an external storage provider from an internal cloud server, if cloud is
crucial ensure internet connectivity redundancy, automatic synchronization
Printers and Multifunction Devices
Laser printer - Rotating cylindrical imaging drum, laser writes a negatively charged image onto
the drum, positively charged toner is then attracted to the drum, pickup rollers bring paper into
the printer, a separation pad ensures that only one piece of paper is fed at a time, lastly the
toner on the drum is the transferred to the negatively charged paper via a transfer belt which is
part of the fuser assembly
Inkjet printer - Uses ink cartridges that are moved across the paper by a carriage belt, rollers
feed the paper into the printer, pressure or electrical pulses force the ink out of jet nozzles,
these cartridges need to calibrated to match the size of the paper, cartridges are expensive,
inkjet is one of the fastest printers
Always reference the manual when servicing a printer
Thermal printer - Common with POS receipts, uses heat sensitive paper, regions are heated to
act like invisible ink
Impact printer - Dot matrix printers that use a print head that uses electrical charges for pins to
form shapes, print head pins then impact the paper through an ink ribbon to form characters on
the paper, useful for printing multiple carbon copies in one print pass
3D printer - Useful for creating prototypes and simple components, additive design
Virtualization and Cloud Computing
Introduction to Virtualization and Cloud Computing
Virtualization - The process of creating a software-based or virtual representation of something,
such as virtual applications, servers, storage, and networks
Hypervisor - Virtualization layer that has all the requisite drivers and applications to control the
hardware
Virtual machines can run multiple servers on a single motherboard/machine, virtual machines
cannot cross-contaminate each other
Major virtualization tools include: VMware (vSphere), Microsoft (Hyper-V), Citrix (Citrix
Hypervisor), Oracle (Oracle VM Server), Red Hat
Cloud Computing - Enables companies to consume a compute resource, such as a virtual
machine, storage, or an application, as a utility rather than having to build and maintain
computing infrastructures in situ
The cloud provider owns the hardware and clients have access to a virtualized environment on
that hardware
Cloud consumption is metered like a utility and is billed on that usage
Virtualization in the Real World
Virtualization requires CPU capability (Intel VT-x, AMD-V), as well as enough RAM/Storage for
workloads, the storage can be local or SAN
Virtual machines are subject to the same security risks as a standard computer
The network will need enough bandwidth to serve all requirements of the virtualized
environments
Type 2 Hypervisors run on OS
Virtualization at the enterprise level uses level 1 (bare metal) hypervisors and do not have a
superseding OS
Cloud Computing in the Real World
On-Premises - The client provides and manages all elements of the hardware and software.
Pizza Analogy - Made from Scratch at Home
Infrastructure as a Service (IaaS) - The service provider manages the networking, storage,
servers, and virtualization hardware, while the client manages applications, data, runtime,
middleware, and OS.
Pizza Analogy - Buying a Frozen Pizza (still need oven, electricity, drinks, dining ware, table)
Popular Services - Microsoft Azure, AWS, Google Compute Engine, Rackspace
Best for - Test and development, storage and backups, high performance computing, big data
analysis
Platform as a Service (PaaS) - The service provider manages all elements except the
applications and data.
Pizza Analogy - Having it Delivered (still need drinks, dining ware, table)
Popular Services - Heroku, Amazon Elastic Beanstalk, Azure Logic Apps
Best for - Analytics or business intelligence, development framework
Software as a Service (SaaS) - The service provider manages everything and the client pays to
use the service.
Pizza Analogy - Dining Out
Popular Services - Microsoft 365, Google Workspace, Salesforce, Dropbox
Best for - Gaining access to sophisticated applications without managing the infrastructure
Public Cloud - A cloud vendor provides cloud services simultaneously to multiple clients using
the same hardware securely
Private Cloud - Hardware is only used by a single company, which often owns the hardware and
datacenter
Hybrid Cloud - Combination of public and private cloud with automation and orchestration of
resources between the two
Community Cloud - Infrastructure is shared by several organizations within a community with
aligned concerns regarding security, compliance, and jurisdiction
Most offerings are in public cloud, if not specified then the service is a public cloud
Private and hybrid clouds have begun adopting PaaS and SaaS models that allow workloads to
be transferred to public clouds more easily
Community clouds are most commonly used by government bodies
Virtual Desktop Infrastructure (VDI) - The process of running a user desktop inside a virtual
machine that lives on a server in the datacenter. It is a useful form of desktop virtualization that
enables fully personalized desktops for each user with all the security and simplicity of a
centrally managed system.
VDI can be used from any computing device (essentially as a boot option) and because it is
borrowing hardware resources from the datacenter, the access point device does not need to be
very powerful, it only needs to be able to access the VDI
Enterprises can enforce security and compliance, as well as restrict certain applications and
information to only being accessible through VDI
VDI can exist through an on-premises/private or a public cloud
Troubleshooting
The Troubleshooting Methodology
Identify the Problem Ensure the problem is properly understood, a symptom is not the problem, it is helpful to be able
to recreate the symptoms.
Ask what the user was doing when the problem arose, ask for exact error message details.
Ask the user what has changed since the time when the system was functioning properly, are
there any restore points or backups we can use to test, have configuration settings changed,
have there been any updates applied, have there been network changes?
Review relevant logs on the device or if there are network logs on parts of the infrastructure.
The most important aspect is knowing which questions to ask and using deductive problem
solving to narrow the range of possible causes. E.g. If more than one user is encountering the
same problem, it is more likely the root cause is serverside rather than clientside.
Establish a Theory of Probable Cause Ask what caused the problem symptoms, if you can recreate the problem then you will know
what the cause is. There could be more than one probable cause and it should be investigated
in the order of likelihood. In the event that no probable cause can be deduced, it will become
necessary to escalate the issue to another department, the service provider, or other
third-parties. Who you escalate to should be laid out within the company's policies.
Start with the obvious possibilities: Is everything receiving power? Is everything plugged in
properly? Have hardware components slipped out of position?
For network issues: Were there any network device firmware updates? Is the network
congested? Have the network configurations been modified?
Always consult pre-existing knowledge bases either internal or external, it is extremely likely this
problem has occurred and been solved elsewhere before.
Test the Theory Start with the most likely cause, determine how best to test this problem, if possible use a virtual
machine in a sandbox environment that runs a backup or snapshot of the user’s system. Your
organization may have tools available for testing network connectivity, or the cloud provider may
have troubleshooting tools. In case you are unable to test your theory, escalate.
Only make one change at a time, document the changes as you make them. If your test fails,
move to the next theory or develop a new theory, otherwise escalate.
Establish a Plan of Action Determine how to roll out the fix, this may need to be scripted or automated for systemic
problems, also prepare a rollback plan in case the fix causes unforeseen issues. Backup data
and configurations, it will be easy to revert back. If you are not able to execute the plan,
escalate.
Determine the solution scope, is it only for a single user device, is it to a server which may
impact many users? Plan the solution’s implementation, schedule the fix and notify users.
Enact the plan, but always ensure there is a rollback plan.
Verify System Functionality Are the affected users happy with the solution? How do we ensure this problem is not
repeated? How do we track the implemented solution over time (logs, monitoring solutions,
etc.)
Discern whether the problem is solved, it may be necessary to consult Subject Matter Experts
(SMEs) to determine whether the solution is appropriate and effective. E.g. If a fix is applied to
a financial services tool, it may be helpful to consult someone familiar with those tools to verify
our solution is good. Have new problems been introduced by the solution, this involves testing
in a sandbox to perform regression testing. Can we make preventative changes to avoid this
problem in the future?
Document Findings Record the problem symptoms, record the solution details, update existing documentation
where applicable.
Document problems, actions, results. It could be reported in an IT incident report, add the
solution to the knowledgebase, be sure to close IT tickets and update any relevant training
materials.
Hardware and Storage Issues
Power issues Sometimes cables fail, other times batteries degrade, insufficient wattage from PSU may cause
failures.
Common symptoms - No POST, Intermittent Power, Random Card/Device failure, Fan Failure,
Breakers Tripped.
Test PSU with multimeter, try a different outlet, test PSU in a different machine
MOBO, CPU, RAM issues Common symptoms - POST beeps/messages/indicators, blank screen on boot, BSOD, random
reboots or shutdowns, CPU overheating, SPoD (Mac BSOD)
Replace faulty components, disable overclocking, test RAM with tools, replace CMOS battery,
check hardware logs
Storage and RAID issues Common symptoms - Failure to read/write, clicking or grinding noise, slower performance, disk
drive not recognized, bootable device not found, RAID not found
Take common backups and ensure the integrity of the backups, Self-Monitoring Analysis and
Reporting Technology (SMART) is disk drive firmware that provides LED display messages
related to imminent or current problems, use RAID diagnostic tools, replace failed disks, test
NAS connectivity, test disk volume, ensure cables are plugged in properly.
Display and Printing Issues
Ensure cables are plugged in properly, if the connection is wireless verify there is adequate
signal strength. Consider electromagnetic interference (EMI) for longer cable runs. Consider
the signal source device.
Common problems - Multiple outputs, power loss, stuck in POST, failing battery, failing GPU,
overheating GPU, bad drivers
Boot in VGA mode, test components with different physical components, adjust the monitor
controls, check temperature, check video settings, update or rollback driver, select correct input
source, check OS settings
Consider the type of printer we are troubleshooting, has anything in the IT environment
changed, is the problem systemic or local?
Common problems - Bad drivers, wrong paper type, too humid, paper jams, print settings, ink
levels, bad permissions
Check print job settings, check error logs through local access, use correct paper type, remove
debris, connect through physical connections, repair printer, replace toner/ink, clean imaging
drum
Mobile Devices and Network Issues
Mobile device issues Common problems - moisture or impact damage, faulty battery, overheating, flickering or dim
displays, lack of response, broken screen, external display failure, ghost cursors, intermittent
wi-fi, bluetooth not pairing, cellular failures, GPS failures, malware, updates, memory
overloaded, bad apps, input issues
Check relevant settings, check SIM card installation, check updates, run malware scans,
uninstall recently apps, take the device in for repairs, reboot the device
Wired network issues Common problems - Network switch error indicators, port flapping, cable failure, network
congestion, card failure, hardware failure, EMI, permission problems
Use ipconfig cmd, ping cmd, ping may be blocked by firewalls, tracert cmd to map the pathway,
nslookup cmd to lookup destination IP
Check IP settings, IPv4 APIPA address should be configured with 169.254 prefix, IPv6 link-local
address should have an FE80 prefix, there could be IP conflicts
Wireless network issues Common problems - Too distant, extender failure, EMI, poor quality, SSID hidden, MAC address
filtering, authentication server failure, expired PKI certificate, slow network, congested network
Core 2 Notes