Chapter 54: PBQ and Scenario Troubleshooting
This chapter follows the topics shown in the Networking chapter menu. Work through each section in order, then use the review questions to check recall and troubleshooting reasoning.
54.1 PBQ Strategy
PBQ Strategy is one of the core topics in PBQ and Scenario Troubleshooting. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to PBQ Strategy. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
54.2 Determine Scope
Determine Scope is one of the core topics in PBQ and Scenario Troubleshooting. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Determine Scope. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
54.3 Follow the Packet
Follow the Packet is one of the core topics in PBQ and Scenario Troubleshooting. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Follow the Packet. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
54.4 Client Test Sequence
Client Test Sequence is one of the core topics in PBQ and Scenario Troubleshooting. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Client Test Sequence. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
54.5 Loopback Testing
Loopback Testing is one of the core topics in PBQ and Scenario Troubleshooting. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Loopback Testing. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
54.6 Gateway Testing
Gateway Testing is one of the core topics in PBQ and Scenario Troubleshooting. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Gateway Testing. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
54.7 Remote-IP Testing
Remote-IP Testing is one of the core topics in PBQ and Scenario Troubleshooting. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Remote-IP Testing. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
54.8 DNS Testing
DNS translates names into resource records such as IP addresses, aliases, mail-routing information, and service data. Client caching and TTL values affect how quickly changes become visible.
Example: a user can reach 203.0.113.20 but cannot reach server.example by name. That difference points toward name resolution, DNS reachability, record content, cache state, or search-suffix behavior rather than basic IP routing.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
54.9 APIPA Scenario
APIPA is the common name for IPv4 link-local self-assignment in 169.254.0.0/16 when a host cannot obtain normal DHCP configuration.
Scenario: a user reports a problem related to APIPA Scenario. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
Command or data example
GET /api/v1/interfaces
Accept: application/json
54.10 Wrong Gateway Scenario
Wrong Gateway Scenario is a troubleshooting condition. The useful approach is to confirm symptoms, determine scope, identify the relevant layer, compare actual values with the intended design, test one theory at a time, and verify service after the fix.
Scenario: a user reports a problem related to Wrong Gateway Scenario. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
54.11 Wrong Mask Scenario
Wrong Mask Scenario is a troubleshooting condition. The useful approach is to confirm symptoms, determine scope, identify the relevant layer, compare actual values with the intended design, test one theory at a time, and verify service after the fix.
Scenario: a user reports a problem related to Wrong Mask Scenario. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
54.12 Duplicate-IP Scenario
Duplicate-IP Scenario is one of the core topics in PBQ and Scenario Troubleshooting. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Duplicate-IP Scenario. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
54.13 DNS Failure Scenario
DNS translates names into resource records such as IP addresses, aliases, mail-routing information, and service data. Client caching and TTL values affect how quickly changes become visible.
Example: a user can reach 203.0.113.20 but cannot reach server.example by name. That difference points toward name resolution, DNS reachability, record content, cache state, or search-suffix behavior rather than basic IP routing.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
54.14 DHCP Exhaustion Scenario
DHCP automatically supplies IP configuration such as an address, mask or prefix, gateway, DNS servers, and lease information. IPv4 clients commonly use the Discover, Offer, Request, Acknowledge exchange.
Example: a laptop joins a LAN with no manual IP configuration. It broadcasts or multicasts the appropriate discovery traffic, receives an offer, requests the selected lease, and then applies the address, gateway, DNS settings, and lease timers.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
54.15 Wrong VLAN Scenario
A VLAN creates a logical Layer 2 broadcast domain on switching infrastructure. Traffic between VLANs requires a Layer 3 forwarding function.
Example: users in VLAN 20 can communicate with one another through switches, but reaching VLAN 30 requires a Layer 3 gateway. If one trunk omits VLAN 20, only paths crossing that trunk fail.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
54.16 Missing VLAN on Trunk
A VLAN creates a logical Layer 2 broadcast domain on switching infrastructure. Traffic between VLANs requires a Layer 3 forwarding function.
Example: users in VLAN 20 can communicate with one another through switches, but reaching VLAN 30 requires a Layer 3 gateway. If one trunk omits VLAN 20, only paths crossing that trunk fail.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
54.17 STP Loop Scenario
STP prevents persistent Ethernet loops by placing selected redundant paths into non-forwarding states and recalculating after topology changes.
Scenario: a user reports a problem related to STP Loop Scenario. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
54.18 Duplex Mismatch Scenario
Duplex Mismatch Scenario is a troubleshooting condition. The useful approach is to confirm symptoms, determine scope, identify the relevant layer, compare actual values with the intended design, test one theory at a time, and verify service after the fix.
Scenario: a user reports a problem related to Duplex Mismatch Scenario. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
54.19 Bad Cable Scenario
Bad Cable Scenario is one of the core topics in PBQ and Scenario Troubleshooting. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Bad Cable Scenario. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
54.20 Fiber Failure Scenario
Fiber Failure Scenario is a troubleshooting condition. The useful approach is to confirm symptoms, determine scope, identify the relevant layer, compare actual values with the intended design, test one theory at a time, and verify service after the fix.
Scenario: a user reports a problem related to Fiber Failure Scenario. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
54.21 PoE Budget Scenario
PoE Budget Scenario is one of the core topics in PBQ and Scenario Troubleshooting. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to PoE Budget Scenario. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
54.22 Wireless Interference Scenario
Wireless Interference Scenario is a wireless-networking concept where RF conditions, channel use, signal level, interference, client capability, and access-point placement all influence the user experience.
Example: two clients see the same SSID, but one has poor performance at the edge of coverage. Compare signal strength, noise, SNR, channel utilization, roaming behavior, and retry rate before assuming the internet circuit is slow.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
54.23 Sticky Client Scenario
Sticky Client Scenario is one of the core topics in PBQ and Scenario Troubleshooting. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Sticky Client Scenario. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
54.24 Jitter Scenario
Jitter is variation in packet delay. Real-time voice and video are especially sensitive to excessive delay variation.
Scenario: a user reports a problem related to Jitter Scenario. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
54.25 High-Latency Scenario
Latency is the time required for traffic to travel between endpoints. Propagation, serialization, queueing, processing, and path choice can all contribute.
Scenario: a user reports a problem related to High-Latency Scenario. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
54.26 Congestion Scenario
Congestion Scenario is one of the core topics in PBQ and Scenario Troubleshooting. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Congestion Scenario. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
54.27 MTU Scenario
MTU Scenario is one of the core topics in PBQ and Scenario Troubleshooting. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to MTU Scenario. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
54.28 VPN DNS Scenario
DNS translates names into resource records such as IP addresses, aliases, mail-routing information, and service data. Client caching and TTL values affect how quickly changes become visible.
Example: a user can reach 203.0.113.20 but cannot reach server.example by name. That difference points toward name resolution, DNS reachability, record content, cache state, or search-suffix behavior rather than basic IP routing.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
54.29 VPN Route Scenario
A VPN creates a protected logical connection across an untrusted or shared network. The design must define endpoints, authentication, encryption, routing, and failure behavior.
Example: a router receives a packet for 10.20.30.40 and has several matching routes. It selects the most specific matching prefix, then forwards toward the route's next hop or exit interface if that path is usable.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
54.30 Firewall Rule Scenario
Firewall Rule Scenario is a network-security concept. A sound design identifies the protected asset, trust boundary, possible abuse path, preventive controls, detection signals, and recovery steps.
Scenario: a user reports a problem related to Firewall Rule Scenario. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
54.31 Missing Route Scenario
Missing Route Scenario affects how Layer 3 devices choose a path toward destination networks. Correct routing depends on the destination prefix, route source, next hop or exit interface, route preference, metric, and reachability of the next step.
Example: a router receives a packet for 10.20.30.40 and has several matching routes. It selects the most specific matching prefix, then forwards toward the route's next hop or exit interface if that path is usable.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
54.32 Routing Loop Scenario
Routing Loop Scenario affects how Layer 3 devices choose a path toward destination networks. Correct routing depends on the destination prefix, route source, next hop or exit interface, route preference, metric, and reachability of the next step.
Example: a router receives a packet for 10.20.30.40 and has several matching routes. It selects the most specific matching prefix, then forwards toward the route's next hop or exit interface if that path is usable.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
54.33 NAT Failure Scenario
NAT changes IP address information as traffic crosses a translation boundary. PAT is a many-to-one form that also distinguishes conversations by transport-layer port numbers.
Scenario: a user reports a problem related to NAT Failure Scenario. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
54.34 Rogue DHCP Scenario
DHCP automatically supplies IP configuration such as an address, mask or prefix, gateway, DNS servers, and lease information. IPv4 clients commonly use the Discover, Offer, Request, Acknowledge exchange.
Example: a laptop joins a LAN with no manual IP configuration. It broadcasts or multicasts the appropriate discovery traffic, receives an offer, requests the selected lease, and then applies the address, gateway, DNS settings, and lease timers.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
54.35 DDoS Scenario
DDoS Scenario is one of the core topics in PBQ and Scenario Troubleshooting. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to DDoS Scenario. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
54.36 ARP Poisoning Scenario
ARP maps an IPv4 address to a local-layer MAC address on an IPv4 LAN. A host normally uses ARP only for destinations it considers local, or for the default gateway when the destination is remote.
Example: a monitoring system reports unusual address mappings and traffic redirection. Preserve evidence, compare neighbor or MAC tables with known values, isolate affected segments, and verify the control that should prevent the spoofing technique.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
Command or data example
arp -a
54.37 Command Selection
Command Selection is one of the core topics in PBQ and Scenario Troubleshooting. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Command Selection. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
54.38 Packet Analysis
Packet Analysis is one of the core topics in PBQ and Scenario Troubleshooting. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to Packet Analysis. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
54.39 FIRST/BEST/NEXT Questions
FIRST/BEST/NEXT Questions is one of the core topics in PBQ and Scenario Troubleshooting. Understand what the term represents, where it operates in the network, what information it uses, and what observable behavior confirms that it is working correctly.
Scenario: a user reports a problem related to FIRST/BEST/NEXT Questions. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.
54.40 Troubleshooting Methodology PBQs
Troubleshooting Methodology PBQs is a troubleshooting condition. The useful approach is to confirm symptoms, determine scope, identify the relevant layer, compare actual values with the intended design, test one theory at a time, and verify service after the fix.
Scenario: a user reports a problem related to Troubleshooting Methodology PBQs. Start by writing the exact symptom, affected users, first known failure time, and recent changes. Then choose the smallest safe test that can prove or disprove one cause.
What to check
- Confirm the symptom and determine whether the problem affects one host, one segment, one site, or many sites.
- Compare actual configuration and measurements with the intended design, baseline, or documentation.
- Change one variable at a time, verify the result, and document both the cause and the final fix.