CompTIA Network+ Preparation · lesson 26 of 30 · 25 min
The CompTIA Troubleshooting Methodology
CompTIA defines a 7-step troubleshooting methodology. The Network+ exam tests both the steps and their order. Memorize this sequence:
1. Identify the problem — gather information, question users, identify symptoms, determine if anything changed recently, duplicate the problem if possible.
2. Establish a theory of probable cause — consider obvious causes first (OSI model top-down or bottom-up). Question the obvious.
3. Test the theory to determine the cause — if the theory is confirmed, proceed to step 4. If not, establish a new theory or escalate.
4. Establish a plan of action to resolve the problem and identify potential effects — plan the fix, consider side effects, get change approval if needed.
5. Implement the solution or escalate as necessary — apply the fix. If unable to resolve, escalate to the appropriate team.
6. Verify full system functionality and, if applicable, implement preventive measures — confirm the fix works, test related systems, implement monitoring.
7. Document findings, actions, and outcomes — record what the problem was, what caused it, how it was fixed, and how to prevent recurrence.
Exam Tip — Step Order
The exam frequently tests step order. Common traps: documentation is LAST (step 7), not first. Verifying comes BEFORE documenting. Testing the theory comes BEFORE implementing the fix.
OSI Model Troubleshooting Approaches
Bottom-up approach — start at Layer 1 (Physical) and work up. Best when the problem is likely hardware-related (new installation, physical change). Check cables → switch ports → IP config → routing → application.
Top-down approach — start at Layer 7 (Application) and work down. Best when the problem is likely software or configuration-related. Check application → transport → network → data link → physical.
Divide and conquer — start in the middle (Layer 3/4) and work up or down based on results. Most efficient for experienced troubleshooters.
Follow the path — trace the traffic path from source to destination, checking each hop.
Swap the component — replace a suspected faulty component with a known-good one.
Common Network Problems and Causes
Duplicate IP address — two devices with the same IP. Symptoms: intermittent connectivity for both devices. Fix: check DHCP exclusions, use IPAM.
Incorrect subnet mask — device thinks remote hosts are local (or vice versa). Symptoms: can ping local hosts but not remote, or vice versa.
Default gateway missing/wrong — device cannot reach other subnets. Symptoms: can ping local hosts, cannot ping anything beyond the local subnet.
DNS failure — names don’t resolve. Symptoms: can ping IP addresses but not hostnames. Test: nslookup hostname.
Duplex mismatch — one side set to full-duplex, other to half-duplex. Symptoms: high collision/error counters, slow performance. Check: show interfaces for late collisions.
VLAN mismatch — access port in wrong VLAN. Symptoms: device cannot communicate with others in the same logical group.
Key Terms
Key Terms
Knowledge Check — 12 Questions
Network Troubleshooting — Methodology
What is the FIRST step in the CompTIA troubleshooting methodology?
- Establish a theory
- Implement the solution
- Identify the problem
- Document findings
Answer: Identify the problem
Step 1 is always identifying the problem — gather information, question users, identify symptoms before theorizing.
What is the LAST step in the CompTIA troubleshooting methodology?
- Verify functionality
- Implement the solution
- Document findings, actions, and outcomes
- Establish a theory
Answer: Document findings, actions, and outcomes
Documentation is the final step (step 7) — record the problem, cause, fix, and prevention measures.
Bottom-up troubleshooting starts at which OSI layer?
- Layer 7 (Application)
- Layer 4 (Transport)
- Layer 3 (Network)
- Layer 1 (Physical)
Answer: Layer 1 (Physical)
Bottom-up starts at the Physical layer — check cables, ports, and hardware before moving to higher layers.
A user can ping IP addresses but not hostnames. The most likely cause is:
- Wrong default gateway
- DNS failure
- Incorrect subnet mask
- Duplex mismatch
- Answer: DNS failure
If IP pings work but hostname resolution fails, DNS is the issue — test with nslookup or dig. A user can ping local hosts but cannot reach anything beyond the local subnet. The most likely cause is:
- DNS failure
- Duplicate IP address
- Missing or incorrect default gateway
- Wrong VLAN
- Answer: Missing or incorrect default gateway
The default gateway is required to route traffic off the local subnet — without it, only local communication works. Late collisions on a switch interface indicate:
- A bad cable
- A duplex mismatch
- A VLAN mismatch
- A DNS failure
- Answer: A duplex mismatch
Late collisions (after the first 64 bytes) are a classic symptom of a duplex mismatch between connected devices.
In the CompTIA methodology, when should you implement the solution?
- Step 2 — after establishing a theory
- Step 3 — after testing the theory
- Step 5 — after establishing a plan of action
- Step 6 — after verifying functionality
Answer: Step 5 — after establishing a plan of action
Implementation is step 5 — after identifying the problem (1), theorizing (2), testing the theory (3), and planning (4).
The “divide and conquer” troubleshooting approach starts at:
- Layer 1
- Layer 7
- Layer 3 or 4 (middle of the OSI model)
- The application layer
- Answer: Layer 3 or 4 (middle of the OSI model)
Divide and conquer starts in the middle — if Layer 3 works, the problem is at Layer 4–7; if not, check Layers 1–2.
Verifying full system functionality should occur before documenting the solution.
- True
- False
Answer: True
Step 6 (verify) comes before step 7 (document) — confirm the fix works before recording it.
Two devices have the same IP address. What symptom would you observe?
- Both devices lose all connectivity permanently
- Intermittent connectivity for both devices
- Only the newer device loses connectivity
- The switch shuts down both ports
Answer: Intermittent connectivity for both devices
Duplicate IPs cause intermittent issues — ARP responses from both devices confuse other hosts, causing unpredictable connectivity.
When should you escalate a problem?
- Immediately, before trying to fix it
- After step 1 (identify the problem)
- When you cannot resolve it at your level after attempting a fix
- Only after documenting
Answer: When you cannot resolve it at your level after attempting a fix
Escalation (step 5) occurs when you cannot implement a solution — pass to the appropriate team with full documentation of what you tried.
Which troubleshooting approach is most efficient for an experienced network engineer?
- Bottom-up
- Top-down
- Divide and conquer
- Follow the path
Answer: Divide and conquer
Experienced engineers use divide and conquer — starting in the middle eliminates half the OSI layers with each test.
Try it: Troubleshooting methodology
Previous lesson: VPN types: site-to-site, remote access, SSL/TLS, IPsec, split tunneling
Back to CompTIA Network+ Preparation
Next lesson: Troubleshooting tools: ping, traceroute, nslookup, netstat, Wireshark, cable tester, OTDR