Scenario Questions - Part 1

When a user can access local files but cannot browse external websites, verify the local Layer 3 health by pinging the default gateway. Next, run an 'nslookup' query to check for DNS resolution failure; if public IPs can be pinged but domain names fail to resolve, the DNS configuration is broken. If pings to public IPs also fail while the gateway responds, inspect the perimeter firewall or edge router for NAT pool exhaustion or an active WAN link outage.

An IP address of 169.254.84.112 indicates that the client operating system automatically assigned an APIPA address because its DHCP Discover broadcast failed to receive a DHCP Offer from a server. The host is restricted to communicating only with other local devices on that same temporary subnet. Resolution requires checking for a full DHCP server scope, resolving incorrect access switch port VLAN assignments, or restoring physical connectivity to the DHCP server.

A successful ping confirms that Layer 3 connectivity is fully functional. The web browser connection timeout points to a failure higher up the network stack: either a Layer 4 issue where a firewall or Access Control List (ACL) is actively dropping HTTP/HTTPS traffic (ports 80/443) while permitting ICMP, or a Layer 7 failure indicating the web server daemon (such as Nginx or Apache) has crashed and is no longer listening on the host.

When bulk file downloads degrade real-time traffic like Zoom calls, implement Quality of Service (QoS) profiles on the branch edge router. Classify time-sensitive video conferencing data as high-priority and place standard TCP downloads into a lower-priority queue. Apply rate-limiting to bulk file traffic and utilize Low Latency Queueing (LLQ) to guarantee a fixed, reserved slice of bandwidth exclusively for real-time streams.

Plugging in a redundant switch that causes the entire network to freeze with frantically blinking status lights indicates a Broadcast Storm resulting from a physical Layer 2 loop. A broadcast packet is being forwarded endlessly in circles between the switches, consuming all available bandwidth. This indicates Spanning Tree Protocol (STP) is either disabled or suffers from conflicting root bridge priorities; disconnect the link immediately and fix the STP configuration.

A single host transmitting thousands of ARP packets per second indicates an active network scanning attack, an ARP Poisoning attempt, or a Man-in-the-Middle exploit. The host is trying to map the local network or overwrite neighbor ARP caches. Immediate response requires administratively shutting down the infected host's switch port, scanning the endpoint for malware, and verifying that Dynamic ARP Inspection (DAI) is enabled on the switch infrastructure.

To allow public web traffic while shielding internal databases, segment the perimeter firewall into three distinct security zones: Outside, DMZ, and Inside. Apply three strict rule definitions: Rule 1 permits Outside traffic to reach the DMZ web servers exclusively on ports 80 and 443; Rule 2 allows DMZ servers to communicate with the Inside zone strictly on the database application ports (e.g., 3306 or 1433); Rule 3 explicitly denies all direct traffic initiated from Outside to Inside.

Connecting a personal home router into an office wall jack introduces a Rogue DHCP Server. The rogue device responds to local client DHCP discovery requests faster than the legitimate enterprise server, handing out incorrect IP subnets and false default gateways that break external connectivity. The immediate fix is to locate and unplug the device; permanent mitigation requires enabling DHCP Snooping on all access switches to drop unauthorized DHCP packets.

To ensure data moving across the public internet between branch offices and headquarters remains completely confidential and tamper-proof, deploy a site-to-site IPSec VPN tunnel between edge firewalls. Configure the tunnel in IPSec Tunnel Mode to encrypt the entire original data packet alongside its inner routing headers, using strong AES-256 encryption algorithms for absolute privacy and SHA-256 hashing via HMAC to validate data integrity.

To isolate sensitive Human Resources payroll data from general Marketing traffic on shared physical switches, configure distinct Virtual LANs (VLANs), assigning HR to VLAN 10 and Marketing to VLAN 20. This logically isolates their broadcast domains so neither department can capture the other's traffic. Any necessary inter-departmental resource sharing must be routed through a Layer 3 firewall or router where strict Access Control Lists (ACLs) filter the data.