--- title: "AP Networking Study Guide & Review | Fiveable" description: "Review AP Networking with unit guides, practice questions, FRQ practice, and key terms aligned to the 2027 AP exam." canonical: "https://fiveable.me/ap-networking" type: "subject" subject: "AP Networking" --- # AP Networking Study Guide & Review | Fiveable ## Overview Use these AP Networking study guides to review all four units, practice configuring and securing real networks, and build the troubleshooting skills the exam scenarios test. Fiveable's AP Networking review has study guides for all 4 units and 35 practice questions. AP Networking, sometimes just called AP Networking, is a yearlong, foundational course where you set up, secure, and troubleshoot networks that grow in size and complexity. It was developed with college faculty and industry leaders and lines up with a typical first-year college networking course. You move from managing your own connections to managing shared, large, and global ones, building practical skills you would use on the job. The course is organized around four skills you return to again and again: connect and configure, secure, troubleshoot, and collaborate. Across four units, you apply those skills to networks of increasing scale. No prior courses are required, which makes this a strong entry point into career and technical education pathways in digital technology. The 2026-27 year is the final pilot year before the course opens nationwide. - Connect and configure devices on a home or small office network - Set up and manage shared connections across multiple users - Segment and switch traffic within larger networks - Route traffic and manage IP addressing across many connections - Secure networks against common threats and vulnerabilities - Troubleshoot connectivity problems using a systematic approach ## AP CED Alignment AP Networking markdown is organized around AP Course and Exam Description course structure, unit topics, exam skills, and question types when available in the source data. - [Unit 1 – Managing My Connections](/ap-networking/unit-1): ## What's This Unit All About? - Everyday devices like laptops, phones, and tablets depend on networks that occasionally break, slow down, or get attacked, and a competent user needs to know how to respond. - The focus here is the endpoint: the single device a person uses, how it connects to a wireless network, how it performs under load, and how it stays protected from threats. - Troubleshooting is treated as a structured process, not guesswork: gather information, try simple fixes first, form a theory, test it, verify the outcome, and document along the way. - Network performance is tied directly to measurable factors like bandwidth, signal strength, CPU usage, RAM usage, and free storage, each with rough thresholds that signal trouble. - Wireless connectivity has its own setup procedure (SSID, password, trust decisions) and its own security posture (encryption standards, WPS settings, password strength). - Physical and digital attacks are framed in terms of real consequences: identity theft, drained bank accounts, damaged credit, ruined business reputation, and compromised devices spreading malware further. - Security controls are matched to specific threats, so the response to phishing differs from the response to shoulder surfing or weak authentication. - AI tools enter the picture as troubleshooting assistants that supplement, but never replace, human verification and conventional diagnostic methods. - The skills in this unit form the foundation for later units on larger networks, servers, and enterprise security by first grounding students in the device they already use. ## Key Concepts and Terms - **Troubleshooting**: The structured process of diagnosing and resolving device or network problems by collecting information, forming a theory of probable cause, testing solutions, and verifying the fix. - **Endpoint device**: An individual user device such as a laptop, phone, or tablet that connects to a network. - **CPU (Central Processing Unit)**: The processor that executes instructions; sustained usage above 80–90% indicates overload and causes sluggish behavior. - **RAM (Random Access Memory)**: Short-term working memory applications use while running; usage above 80–90% signals memory pressure. - **Task manager**: A built-in utility that shows how much CPU, RAM, and other resources each process is consuming. - **Bandwidth**: The amount of data a network can carry at a given moment, a key determinant of connection speed. - **SSID (Service Set Identifier)**: The name that identifies a wireless network when a device scans for available connections. - **Wireless access point**: The hardware that broadcasts a Wi-Fi signal; proximity to it affects signal strength and reliability. - **Ethernet**: A wired network connection that is typically more reliable and less prone to interference than Wi-Fi. - **WPA3, WPA2, WPA, WEP**: Wireless encryption standards, from strongest (WPA3) to insecure (WPA and WEP, which should be avoided). - **WPS (Wi-Fi Protected Setup)**: A convenience feature for joining networks that introduces security weaknesses and should be turned off. - **Malware**: Malicious software that can slow devices, crash systems, expose files, allow remote control, or spread to other systems. - **Phishing**: Deceptive messages, spoofed emails, or fake websites that trick users into revealing credentials or downloading malware. - **Shoulder surfing**: Unauthorized observation of a screen or keyboard to collect sensitive information. - **Multifactor authentication (MFA)**: A login method that layers additional verification (a code, a token, a biometric) on top of a password. - **Biometric verification**: Authentication based on unique physical traits such as fingerprints or facial features. - **PII (Personally Identifiable Information)**: Data that can identify a specific individual, such as name, address, Social Security number, or financial records. - **Security control**: A safeguard (technical, physical, or procedural) put in place to reduce a specific vulnerability. ## The Troubleshooting Process - Troubleshooting begins with information gathering before any fix is attempted. - Ask the user what stopped working, what they were doing when it broke, and whether the problem is intermittent or constant. - Quick, well-known fixes come before formal diagnosis to save time and effort. - Reboot the device, check that the Ethernet cable is plugged in, or toggle Wi-Fi off and on. - Diagnostic tools help form a theory of probable cause and narrow the list of possible solutions. - A task manager showing 95% CPU usage points to an overloaded processor rather than a network issue. - Solutions are prioritized by time, difficulty, cost, and how disruptive they are. - Closing unused browser tabs comes before buying additional RAM or replacing the laptop. - After applying a fix, verify that normal operation has returned. - Reopen the app that was crashing or reload a webpage to confirm the internet connection works. - If the first fix fails, the root cause may be wrong or there may be multiple problems, so the cycle restarts. - Every step should be documented so later troubleshooters (or the same person next week) can retrace the work. - AI tools can suggest likely causes from error messages and recommend fixes, but their output must be verified manually and paired with human judgment. ## Diagnosing Device Performance Problems - Slow, frozen, or crashing applications usually trace back to one of four resource problems: CPU, RAM, storage, or network. - A video call that stutters while a large game downloads in the background is a bandwidth problem, not a CPU problem. - CPU overload shows up as sustained usage above 80–90% in the task manager. - Fix by ending high-usage or unresponsive processes. - RAM pressure, also seen above 80–90%, causes apps to lag or stop responding. - Fix by clearing temporary files, closing apps, or adding more RAM if the problem persists. - Low free storage (below roughly 10% of capacity) slows file access and degrades overall performance. - Fix by deleting unused apps and files, moving data to external drives or cloud storage, or upgrading the drive. - Weak or dropped wireless signals prevent apps from loading or syncing. - The notification bar's network icon is the first place to check signal strength and connection status. - Overheating triggers automatic performance throttling, sudden shutdowns, or connectivity drops as self-protection. - Common causes include blocked vents, prolonged heavy CPU load, or using a laptop in direct sunlight. ## Connecting to and Optimizing a Wireless Network - Joining a Wi-Fi network requires the wireless adapter to be enabled, the correct SSID selected, and the password entered (case-sensitive). - A capital letter typed as lowercase is the most common reason a "correct" password fails. - Users should connect only to trusted networks and avoid unknown or unprotected ones that could expose data. - Open coffee-shop Wi-Fi without a password lets others on the same network potentially intercept traffic. - After connecting, verify the link works by checking the network icon and loading an actual webpage or resource. - Different tasks demand different combinations of bandwidth and device performance. - Streaming 4K video needs high bandwidth; competitive online gaming needs low latency; editing a large spreadsheet needs CPU and RAM. - Available bandwidth can be increased by removing other devices from the network or pausing large downloads and updates. - Signal strength improves with proximity to the router, fewer walls or obstructions in the path, or switching to wired Ethernet when available. - Device-side performance for heavy tasks improves by closing unused apps and browser tabs and removing temporary or unused files. ## Threats to Devices and Their Consequences - Physical and digital attacks share the same goal: unauthorized access to accounts, data, or devices. - Exposed personal data can include financial records, health information, and PII, any of which can be sold, leaked, or used for fraud. - Stolen credentials have been used to open fraudulent credit cards, apply for loans, or drain bank accounts. - Individual victims may face damaged credit scores, debt, and long-term identity misuse. - For a small business, the consequences extend to reputation damage, lost customer trust, bad publicity, and interrupted operations. - A leaked customer database or a ransomware shutdown can end a small company. - Malware causes abnormal behavior, slowdowns, crashes, and unusable devices. - Beyond local damage, infected devices can spread malware across a network to other systems. - Attackers may use malware to access files, monitor activity through a keylogger or webcam, or remotely control the device. ## Matching Security Controls to Specific Threats - A security control should be chosen based on the specific vulnerability it addresses. - Weak authentication is countered with strong passwords, MFA, and biometric methods. - A long passphrase plus a fingerprint scan is harder to defeat than a short password alone. - Phishing is countered with email filtering that blocks malicious messages and user training to recognize and report suspicious content. - A spoofed email claiming to be from a bank, asking the user to "verify" their password through a link, is a classic phishing attempt. - Shoulder surfing is countered with privacy screens that narrow the viewing angle and by positioning screens away from high-traffic areas. - A laptop used on an airplane or in a crowded cafe is exposed unless angled or filmed. - Malware is countered with antivirus and antimalware software, updated regularly, and with operating system and application patches that close known vulnerabilities. - Unpatched software is how many large ransomware incidents gain their initial foothold. ## Securing a Wireless Network - Wireless convenience comes with exposure to interception and unauthorized access, so the network's own settings matter as much as the device's. - Data should be encrypted before transmission so captured packets are unreadable. - Encryption should be set to the strongest level the router supports. - WPA3 is recommended, WPA2 is the minimum acceptable, and WEP or WPA should be avoided entirely. - WPS should be disabled because it introduces a shortcut attackers can exploit. - The network should use a unique SSID so it is not confused with a default or spoofed network. - Passwords on the wireless network itself should be long, complex, and unique, not reused from other accounts. - A router still using its factory-default admin password is a standard entry point for attackers scanning home networks. - [Unit 2 – Managing My Shared Connections](/ap-networking/unit-2): ## What's This Unit All About? - Small office/home office (SOHO) networks are the focus, covering the full lifecycle of owning one: troubleshooting breakdowns, documenting what exists, upgrading hardware and addressing, adding advanced features, and locking it down against threats. - Diagnostic thinking sits at the center, with command-line tools like ping, ipconfig, and ifconfig paired with physical cues such as router indicator lights to isolate where a connection has failed. - IPv4 addressing gets heavy treatment, including the difference between public, private, APIPA, and loopback ranges, plus when to assign addresses dynamically via DHCP versus statically. - Network documentation practices are introduced as both a planning tool and a troubleshooting aid, with diagrams showing endpoints, infrastructure devices, cabling types, and MAC/IP addresses. - Device selection decisions tie hardware choices (desktops, IoT devices, mobile devices, VoIP phones, POS terminals) and cable choices (twisted pair, coaxial, fiber optic, wireless) to specific user needs around performance, cost, mobility, and interference. - Advanced configuration shows up through evaluating AI-generated network advice and setting up a local media server on a NAS, computer, or gaming console for streaming, file sharing, or multiplayer gaming. - Security coverage moves from identifying weaknesses (weak passwords, default configurations, unpatched firmware, insecure IoT) to applying controls (WPA2/WPA3 encryption, firmware updates, firewalls, network segmentation, guest networks). - The security themes build directly on the addressing and documentation work: segmentation only makes sense once students can map a network, group devices by role or risk, and reason about how traffic flows. ## Key Concepts and Terms - **SOHO network**: A small office/home office network supporting a limited number of users on a single LAN, typically in a home or small business. - **Router**: A device that moves data between outside networks and the local network, often combined with a modem in one unit. - **Switch**: A device that links wired devices and manages traffic inside a LAN. - **Wireless access point (WAP)**: A device that provides wireless connectivity by attaching to a switch or router. - **Wireless gateway**: A single device that combines the functions of a modem, router, switch, and WAP, common in SOHO setups. - **Endpoint**: Any device that joins a network to send and receive data, such as a laptop, phone, printer, NAS, IoT device, or VoIP phone. - **Ping**: A CLI tool that tests whether a host is reachable and measures response time; response times over 100ms or lost packets suggest congestion or hardware issues. - **ipconfig / ifconfig**: CLI commands (Windows and Linux respectively) for inspecting a device's IP settings and diagnosing local network problems. - **APIPA address**: An automatically assigned address in the 169.254.0.0 to 169.254.255.255 range, indicating DHCP failed to issue a real address. - **Loopback address**: 127.0.0.1, which refers back to the local machine and signals the device may not be connected to any network. - **Public IP address**: A unique, ISP-assigned address directly reachable from the internet. - **Private IP address**: An address used only inside a LAN, falling in the Class A (10.x.x.x), Class B (172.16 to 172.31.x.x), or Class C (192.168.x.x) ranges. - **DHCP (Dynamic Host Configuration Protocol)**: A service that automatically assigns and configures IP addresses for devices currently on the network. - **Static IP address**: A manually configured address that does not change, used for devices like servers, printers, and security systems. - **Firewall**: A technical control that permits or blocks traffic based on rules about IP addresses, ports, and protocols. - **Network segmentation**: Splitting a network into smaller zones to isolate sensitive devices, limit lateral movement, and reduce unnecessary traffic. - **Guest network**: A wireless segment kept separate from the main network so visitors can reach the internet without touching internal resources. - **WPA2 / WPA3**: Encryption standards for wireless traffic; enabling them (and disabling WPS) is a baseline security control for home routers. ## Troubleshooting SOHO Connectivity - Start with common fixes before deeper diagnostics: reboot the router or WAP, reseat loose cables, swap damaged cables or connectors. - Read indicator lights on routers and switches to spot hardware and link problems. - Green (steady or flashing) generally means normal operation. - Red or orange may point to a failed connection or hardware fault. - Unlit ports may indicate a bad port, a bad cable, or an unplugged cable. - Use ping to test reachability and latency. - `ping 8.8.8.8` checks external connectivity against a Google public server. - Response times above 100ms, or packet loss beyond 1 to 2 percent, suggest congestion or hardware problems. - 100 percent packet loss or no reply suggests a local failure or disconnection. - Use ipconfig (Windows) or ifconfig (Linux) to inspect address settings. - A 169.254.x.x APIPA address means DHCP failed; fix by rejoining the network or running `ipconfig /release` then `ipconfig /renew`. - Only a 127.0.0.1 loopback result means the device has no real network connection; verify Wi-Fi and the network adapter are on, or reboot. - Match fixes to symptoms rather than guessing. - For red, orange, or unlit indicator lights: swap the Ethernet cable or move it to another port. - For slow ping times: switch from Wi-Fi to wired, pause large downloads, or move closer to the WAP. - Confirm the fix worked by reaching internet resources, servers, printers, or shared drives with no lag; if problems persist, collect new diagnostic data and continue. ## Documenting and Mapping the Network - Network diagrams serve two purposes: planning a build and recording an existing setup for later maintenance. - A good diagram shows endpoints, servers, routers, switches, firewalls, and access points, with solid lines for wired links and dashed lines for wireless links. - Each device should be labeled with its MAC address and IP address to speed troubleshooting and support future expansion. - Typical SOHO parts to document: endpoints, firewalls, routers, switches, access points, and cabling. - Cable choices depend on where the link sits in the network. - Twisted pair (Ethernet) is the most common internal wired medium. - Coaxial or fiber optic is often used by ISPs for the outside link to the SOHO router. ## IPv4 Addressing and Assignment - Public addresses are unique, ISP-assigned, and directly reachable from the internet; they carry traffic between networks. - Private addresses stay inside a LAN; routers drop traffic destined for them, which adds a layer of isolation from outside sources. - Class A: 10.0.0.0 to 10.255.255.255 - Class B: 172.16.0.0 to 172.31.255.255 - Class C: 192.168.0.0 to 192.168.255.255 - APIPA (169.254.0.0 to 169.254.255.255) is a fallback assigned automatically when DHCP is down or misconfigured. - Loopback (127.0.0.1 most commonly) lets a device send data to itself for testing. - Dynamic addressing via DHCP suits flexible, high-turnover environments. - Fits mobile and temporary devices such as laptops, tablets, and guest phones. - Standard in homes and small offices because it minimizes manual work. - Static addressing suits devices that need a consistent address. - Examples include servers, networked printers, security cameras, and remote-access services. - Requires manual configuration and careful tracking to avoid address conflicts. ## Choosing Devices and Transmission Media - Match endpoint type to user task. - Computers (desktops, laptops, servers) fit multitasking work like content creation, software development, or data analysis. - IoT devices (thermostats, smart TVs, security systems, wearables) handle automation, monitoring, streaming, and remote control. - Mobile devices (smartphones, tablets, handheld gaming) give flexible communication and on-the-go app access over wireless. - Specialized endpoints include printers and scanners for documents, VoIP phones for voice over internet, and POS terminals for transactions and inventory. - Weigh placement, performance, interference, installation difficulty, and cost when picking a medium. - Twisted pair (UTP and shielded STP) is cheap, easy to install, and reaches up to 10Gbps over 100 meters; STP helps in high-EMI areas like near HVAC or fluorescent lighting. - Wireless (Wi-Fi) is cheap and flexible, with 500Mbps to 1Gbps possible, but is prone to signal loss from walls, other devices, or crowded airspace. - Coaxial is moderate cost, up to 1Gbps with signal loss beyond 450 meters, stiffer to install, and mostly seen in older buildings or ISP connections. - Fiber optic hits 1 to 100Gbps over distances up to 100 km and is immune to EMI, but is fragile, expensive, and uncommon inside SOHO LANs. ## Advanced Features: AI Advice and Media Servers - AI tools can suggest designs, configurations, or troubleshooting steps for a SOHO network, but quality depends on the prompt. - Strong prompts specify user count, device types, internet usage patterns, and budget. - Vague prompts tend to produce impractical, overly complex, or technically wrong recommendations (unrealistic hardware, bad IP plans). - Evaluate AI output against real SOHO criteria: performance, cost, wireless coverage, ease of setup, security, and user-friendliness. - A local media server stores files, streams content, and hosts multiplayer games on the LAN. - Common hosts include a NAS, a computer, or a gaming console with enough memory, storage, and processing power. - A wired connection to the network is recommended for speed and reliability. - File-sharing or streaming software must be installed and pointed at the shared folders that hold the media or game files. - Assigning a static IP or hostname makes the server easier for other devices to find consistently. - Verify the setup by connecting from a separate device and confirming access. - Compared with cloud services, a local media server offers greater control, faster access, stronger privacy, and often lower cost. ## Securing the SOHO Network - Weak security controls let unauthorized users in, expose or destroy sensitive data, and interrupt services like printing, file sharing, or internet access. - Common weaknesses include weak passwords, unchanged defaults, unpatched firmware, and unmonitored devices. - Default router credentials are widely known and easy to guess, letting adversaries alter configurations or disable controls. - Out-of-date firmware or untrusted devices can introduce malware or compromise endpoints. - Insecure IoT devices and unknown guest devices are common footholds for lateral movement. - Apply controls that target the specific weakness. - Replace default login credentials on routers, access points, and IoT devices. - Enable WPA2 or WPA3 encryption and disable WPS. - Install firmware updates regularly and turn on automatic updates where available. - Place IoT devices on their own segment, apart from critical systems and data. - Set up a guest network that isolates visitors from internal resources. - Firewalls and segmentation are the core technical controls. - Firewalls filter inbound and outbound traffic using rules based on IP addresses, ports, and protocols, narrowing the attack surface. - Segmentation splits the network into zones that wall off sensitive or high-risk devices, cut unnecessary traffic, and block lateral spread of malware. - Group devices into segments by shared traits. - By role: security cameras, media equipment like streaming servers and game consoles, or family devices like phones and laptops. - By risk level: hardened servers and office computers in one zone, vulnerable IoT like smart TVs and thermostats in another, guest devices on a separate wireless segment. - By performance needs: online gaming consoles, streaming servers, or remote rendering and video editing workstations that benefit from prioritized high-bandwidth or low-latency traffic. - By user type: office departments like accounting and sales, or school roles like technicians, teachers, and students. - [Unit 3 – Managing Many Connections](/ap-networking/unit-3): ## What's This Unit All About? - Networks in the real world rarely consist of a single flat group of devices; they are deliberately divided into segments so that performance, security, and management all improve. - The focus here is on designing, building, securing, documenting, and repairing a segmented local area network (LAN) that serves many kinds of users and devices. - Device selection comes first: matching endpoints (laptops, tablets, smartphones, desktops, gaming consoles, servers) to user roles, performance demands, and mobility needs. - Segmentation is explored through three lenses: physical separation using dedicated hardware, logical separation using VLANs and subnets, and wireless separation using multiple SSIDs. - IP addressing, subnet masks, and CIDR notation form the mathematical backbone, letting a technician decide whether two devices share a network or need a router to communicate. - Security is treated as a design requirement, not an afterthought: wireless encryption, MAC filtering, firewall ACLs, guest network isolation, and least-privilege access controls all work together to block unauthorized access and lateral movement. - Troubleshooting ties everything together, pairing documentation habits with diagnostic tools (ping, signal analyzers, power analyzers) to isolate root causes such as DHCP exhaustion, APIPA addresses, misconfigured gateways, firewall rule ordering, EMI, or unstable power. - AI-generated network designs are treated critically: useful for brainstorming topologies and spotting gaps, but always requiring human verification against real requirements. - Together, these skills prepare students to plan a small office or school LAN end to end, from choosing a laptop model to writing an ACL rule to fixing a flaky wireless segment. ## Key Concepts and Terms - **Segmentation**: Dividing a network into smaller groups of devices to improve performance, manageability, and security. Can be physical (separate hardware) or logical (VLANs, subnets). - **VLAN (Virtual LAN)**: A logical grouping of devices on a shared physical switch that keeps their traffic isolated from other VLANs without needing extra hardware. - **Subnet mask**: A 32-bit value of leading 1s followed by 0s that marks which bits of an IPv4 address are network bits and which are host bits. - **CIDR notation**: A shorthand like /24 that gives the count of 1 bits in a subnet mask (for example, /24 equals 255.255.255.0). - **Default gateway**: The router interface a device sends traffic to when the destination lies outside its own network segment. - **Routing table**: A list inside a router that maps destination networks to the interfaces or next hops used to reach them. - **SSID (Service Set Identifier)**: The name advertised by a wireless network that clients use to join it. - **WPA2 / WPA3**: Current wireless encryption standards that protect data in transit; WEP is the outdated, insecure predecessor. - **DHCP (Dynamic Host Configuration Protocol)**: A service that hands out IP addresses, subnet masks, and gateway information automatically from a pool. - **APIPA address**: A self-assigned address (169.254.x.x range) a device falls back to when DHCP fails; these addresses cannot communicate beyond the local link. - **ACL (Access Control List)**: An ordered list of firewall rules that permit or deny traffic based on direction, IP, port, service, or application; evaluated top-down with the first match executed. - **MAC filtering**: A control that permits only approved MAC addresses on a switch port, blocking unknown devices and helping prevent MAC flooding attacks. - **MAC flooding**: An attack that overflows a switch's CAM table with fake MAC addresses, potentially forcing the switch into a fail-open broadcast state. - **Star topology**: A layout where every node connects to a central switch; easy to expand and troubleshoot but the switch is a single point of failure. - **Mesh topology**: A layout where every node links directly to every other node, offering high fault tolerance at the cost of cabling and complexity. - **Principle of least privilege**: Granting users and devices only the minimum access required to perform their work. - **ping**: A command that sends ICMP packets to a target IP to verify reachability and basic connectivity. - **Captive portal**: A sign-in page a guest network can require before granting internet access, often used to display terms of use. ## Choosing Endpoints and Topologies - Endpoint selection follows the user's role and performance demand, not a one-size-fits-all rule. - Laptops for workers juggling many browser tabs, documents, and applications. - Tablets and smartphones for mobile dashboards, inventory scans, or field forms. - Desktops or high-performance laptops with wired Ethernet for admin workstations and local servers. - Gaming consoles or high-spec desktops for esports, video editing, and large-data analysis where low latency and high frame rates matter. - Most real networks mix several device types rather than standardizing on one. - Wired topology choice balances reliability, cost, and maintainability. - Star: cheap, simple, central switch is the weak point. - Mesh: high fault tolerance through redundant paths, but expensive and cable-heavy. - Hybrid: common in large LANs, combining star simplicity with mesh resilience where it counts. - Bus and ring layouts are generally avoided in modern designs. ## Addressing, Subnetting, and How Traffic Moves - An IPv4 address is 32 bits written as four dotted-decimal octets (0 to 255 each), split by the subnet mask into network bits and host bits. - /24 corresponds to 255.255.255.0, leaving 8 host bits and 254 usable addresses. - /26 corresponds to 255.255.255.192, leaving 6 host bits and 62 usable addresses. - Two devices share a network only when their network portions match under the same mask. - 192.168.1.10 and 192.168.1.20 under /24 share a network. - 192.168.2.30 under /24 does not. - When the destination is on the same segment, a switch delivers the frame directly to the destination MAC. - When the destination is on a different segment, the host sends the packet to the default gateway, which consults its routing table and forwards it toward the correct network. - Subnetting carves one network into smaller pieces by reassigning host bits as network bits. - Usable hosts per subnet equal 2^n minus 2, where n is the number of host bits. - A subnet of 27 hosts needs at least 32 addresses, so 5 host bits. - The first address is the network ID and the last is the broadcast address; neither can be assigned to a device. - Subnets map cleanly onto VLANs or segments and should use nonoverlapping address ranges. ## Building and Securing a Segmented LAN - Physical LAN setup requires planning first, then cabling, connectors (such as RJ45), crimpers, labeling tools, and PPE. - Switches are configured via CLI through a console cable or through a GUI management console, setting password, IP address, and subnet mask. - Routers must be given an IP and subnet mask to serve as the default gateway for their segment. - Wireless access points need an SSID, IP address, subnet mask, and security settings (WPA2 or WPA3, WPS disabled). - Endpoints receive IP configuration either statically or through DHCP, and connectivity is verified with ping. - Segmentation strategies are chosen by sensitivity, access needs, and traffic patterns. - User workstations, internal services, IoT devices, and guest access each belong in separate segments. - Physical segmentation for maximum isolation (restricted labs, sensitive departments). - VLANs for flexible separation on shared switch hardware. - Subnetting for firewalling IP groups and controlling broadcast scope. - Multiple SSIDs to split wireless users (for example, staff vs. guests), often mapped to distinct VLANs. - Guest wireless networks should be built after the internal network is confirmed working, with their own SSID, strong password, WPA2/WPA3 encryption, optional device limits, time restrictions, blocked access to internal resources, and a captive portal. - AI tools can suggest topologies and segment layouts, but prompts must specify traffic flow, security policies, redundancy, and physical constraints, and every output must be reviewed before deployment. ## Threats, Controls, and Firewall Rules - Common impacts on a segmented LAN include unauthorized access, rogue device connections, and data exposure, all of which threaten confidentiality, integrity, and availability. - Weak wireless security (simple passwords, WEP, no encryption) opens sensitive resources to outsiders. - Misconfigured firewall rules enable lateral movement from one compromised segment to others. - Controls apply the principle of least privilege. - Isolated guest wireless kept off the internal network. - Distinct IP ranges or DHCP pools per device group. - MAC address filtering to allow only approved devices on a port. - Disabling unused switch ports. - DHCP reservations for known devices. - Deny-by-default firewall policies between subnets, permitting only essential cross-segment services (for example, a shared print service). - MAC filtering also defends against MAC flooding, which can overflow a switch's CAM table and push it into fail-open broadcast mode. - Firewall ACLs are ordered lists evaluated top-down; only the first matching rule fires. - Each entry specifies direction (inbound/outbound), criterion (IP, port, service, application), and action (permit/deny). - Permit HTTPS (443), DNS (53), SSH (22), SFTP (22) as needed. - Block or avoid HTTP (80), Telnet (23), FTP (21) because they transmit without encryption. - Specific rules must come before broad deny rules, or legitimate traffic gets blocked (for example, swapping an SSH-allow and a deny-all reverses the intent). - After configuration, administrators verify with ping that intended access works and unauthorized access is blocked. ## Documentation and Troubleshooting - Good network documentation is complete, clear, distributed to all users, and updated with every change. - Visual topology diagrams label devices, show wired and wireless links, and depict both physical and logical segmentation. - IP addressing schemes are recorded, with static assignments flagged. - Segments with special firewall rules or access controls are noted so the right security is applied. - Troubleshooting begins with standard remedies: reboot the AP, switch, or router; reboot affected devices; disconnect and reconnect; verify SSID and password. - Diagnostic clues point to specific root causes. - APIPA address indicates DHCP server failure or exhausted pool. - Missing or wrong subnet mask or gateway blocks network access; check configuration against documented settings. - ping failures to internal or external targets suggest firewall or ACL issues. - Signal below 70 dBm suggests the AP is too far or obstructed; heavy noise suggests EMI from Bluetooth, microwaves, or similar sources. - Power irregularities (under 110V or over 125V in a 120V system, dropouts under 5 seconds) can reboot devices and corrupt routing tables or DHCP leases. - Fixes are matched to the diagnosed cause. - Reboot the DHCP server, widen its pool, or shorten lease times. - Correct gateway and mask settings, or fix DHCP scope options. - Reorder ACLs so allow rules precede broad denies, and audit deny rules for unintended blocks. - Reposition the access point, remove obstructions, or move it away from EMI sources. - Swap circuits or install a UPS for power problems. - Verification closes the loop: confirm devices maintain a stable connection and can reach the internal and external resources they need. - [Unit 4 – Managing Our Global Connections](/ap-networking/unit-4) ## Where To Start - Start with the course overview to understand the full AP Networking map. - Review the 4 course units in order, then use topic guides for focused review. ## Exam Format Here is what is known about the AP Networking pilot exam format. College Board has not yet published question counts, timing, or weighting. ## Units - [Unit 1 – Managing My Connections](/ap-networking/unit-1), 4 study guides - [Unit 2 – Managing My Shared Connections](/ap-networking/unit-2), 6 study guides - [Unit 3 – Managing Many Connections](/ap-networking/unit-3), 6 study guides - [Unit 4 – Managing Our Global Connections](/ap-networking/unit-4) ## Collections - [Connect and Configure](/ap-networking/networking-skills/connect-and-configure/study-guide/0u659iq6NRxW7LaKxLRP) - Networking Skills - [Secure](/ap-networking/networking-skills/secure/study-guide/tbJ0w0h0YOeV6KgATgfF) - Networking Skills - [Troubleshoot](/ap-networking/networking-skills/troubleshoot/study-guide/0kM8uMiEm0cGXC4bn9gI) - Networking Skills - [Collaborate](/ap-networking/networking-skills/collaborate/study-guide/gHv77VnVSFoqC0U8QWh4) - Networking Skills ## How To Study Treat AP Networking as a hands-on course, not a memorization course. Work through the units in order, since each one builds on the last as networks scale from a single device to global systems. For every topic, ask how you would connect, configure, secure, or troubleshoot it as a real technician. Use the four networking skills as your study checklist and apply them to each new unit. Since exam questions use workplace scenarios, practice reasoning through realistic setups rather than reciting terms. Revisit earlier units often so your skills stay sharp as complexity grows. - Week 1: Review Unit 1 and practice connect and configure on a home network - Week 2: Work through Unit 2 shared connections and the secure skill - Week 3: Study Unit 3 switching, segmentation, and routing scenarios - Week 4: Cover Unit 4 global connections and the collaborate skill - Week 5: Drill troubleshoot across all four units with scenario practice - Week 6: Take mixed multiple-choice practice and review weak topics ## Cram Plan Short on time? Focus on the four core skills and move quickly through each unit by scale. Prioritize the configuration, security, and troubleshooting reasoning that scenario questions reward, and save pure definitions for last. - **Day 1**: Unit 1 connections plus connect and configure skill - **Day 2**: Unit 2 shared connections plus the secure skill - **Day 3**: Unit 3 switching, segmentation, and routing - **Day 4**: Unit 4 global connections plus the collaborate skill - **Day 5**: Troubleshoot scenarios across all units - **Day 6**: Mixed multiple-choice practice and quick review ## Top Study Guides - [1.1 Fixing What’s Slowing Me Down: Troubleshooting Issues on My Device](/ap-networking/unit-1/fixing-whats-slowing-me-down-troubleshooting-issues-on-my-device/study-guide/4RaoO5lX2gJ2feys6mD3) - Unit 1 – Managing My Connections - [1.2 Getting the Most Out of My Network: Connecting and Optimizing My Device](/ap-networking/unit-1/getting-the-most-out-of-my-network-connecting-and-optimizing-my-device/study-guide/E1H4STy8fCNLwtv5yGiB) - Unit 1 – Managing My Connections - [1.3 What Could Go Wrong: Identifying the Security Needs of My Device](/ap-networking/unit-1/what-could-go-wrong-identifying-the-security-needs-of-my-device/study-guide/BteMi2ucBsAeWRwopmbx) - Unit 1 – Managing My Connections - [1.4 Locking It Down: Securing My Device](/ap-networking/unit-1/locking-it-down-securing-my-device/study-guide/uRWW1WhjNz32BZyfVy09) - Unit 1 – Managing My Connections - [2.1 Missed Connection: Troubleshooting My SOHO Network](/ap-networking/unit-2/missed-connection-troubleshooting-my-soho-network/study-guide/ArEgbInt5ZrhfYyGPhIi) - Unit 2 – Managing My Shared Connections - [2.2 Identification Needed: Documenting My Network](/ap-networking/unit-2/identification-needed-documenting-my-network/study-guide/MVK7TBKyX8PT6V2lt11z) - Unit 2 – Managing My Shared Connections - [2.3 Smart Moves: Upgrading My Network](/ap-networking/unit-2/smart-moves-upgrading-my-network/study-guide/EvWVIECtes55HF6m8IhS) - Unit 2 – Managing My Shared Connections - [2.4 Leveling Up: Advanced Features on My Network](/ap-networking/unit-2/leveling-up-advanced-features-on-my-network/study-guide/xGnFylsRh9ypZBs6fpGi) - Unit 2 – Managing My Shared Connections - [2.5 Guarding My Network: Identifying Security Needs](/ap-networking/unit-2/guarding-my-network-identifying-security-needs/study-guide/HLYf0fvNHsXJwDO2MhxJ) - Unit 2 – Managing My Shared Connections - [2.6 Applying Defense: Securing My Network](/ap-networking/unit-2/applying-defense-securing-my-network/study-guide/Cir1z2zvAjzW7kcDF9TF) - Unit 2 – Managing My Shared Connections - [3.1 Planning a Network: Choosing the Right Devices and Connections](/ap-networking/unit-3/planning-a-network-choosing-the-right-devices-and-connections/study-guide/Ifw3uIQKI9EQVOMWXNZb) - Unit 3 – Managing Many Connections - [3.2 Creating a Network: Switching and Topologies](/ap-networking/unit-3/creating-a-network-switching-and-topologies/study-guide/tDsyXPBIF0IQ0nHTibd9) - Unit 3 – Managing Many Connections - [3.3 Making It Work: Connecting, Configuring, and Verifying Access](/ap-networking/unit-3/making-it-work-connecting-configuring-and-verifying-access/study-guide/AAosUuInYeMIwbCq4FEW) - Unit 3 – Managing Many Connections - [3.4 Building the Boundaries: Identifying Segmentation Security](/ap-networking/unit-3/building-the-boundaries-identifying-segmentation-security/study-guide/xCLbv6oenwFV6bgjvSqa) - Unit 3 – Managing Many Connections - [3.5 Controlling the Traffic: Firewalls and Filtering](/ap-networking/unit-3/controlling-the-traffic-firewalls-and-filtering/study-guide/IKfJrLOczO6yxjT6WDgk) - Unit 3 – Managing Many Connections - [3.6 Restored Connections: Documenting, Diagnosing, and Fixing a Segmented LAN](/ap-networking/unit-3/restored-connections-documenting-diagnosing-and-fixing-a-segmented-lan/study-guide/91u0Y8WXBDSYSkz6kJht) - Unit 3 – Managing Many Connections ## About This Document Canonical Fiveable pages are available as Markdown at the same path plus `.md`. - [llms.txt](https://fiveable.me/llms.txt): index of Fiveable's sections and URL patterns - [llms-full.txt](https://fiveable.me/llms-full.txt): complete subject and unit listing - [MCP server](https://fiveable.me/mcp): call Fiveable as tools instead of fetching pages (`https://fiveable.me/api/mcp`) - [MCP server for AP teachers](https://fiveable.me/mcp/teachers): a teacher's classes, assignments and AP-rubric grading (`https://fiveable.me/api/mcp/teacher`)