Before we can diagnose either fault, we need the same mental framework Jamie is using. Networking has two reference models: the OSI model with 7 layers, and the TCP/IP model with 4 layers. OSI is the conceptual model — the teaching framework everyone uses when describing how a protocol or device fits into the stack. TCP/IP is the practical model — the one actually running on every device. When Jamie says the fault is at Layer 2, he means the Data Link layer — frames, MAC addresses, switches. When he says Layer 1, he means physical — cables, power, port hardware. Both incidents map to different layers, which is how he knew straight away that they were separate faults.

From the bottom up: Layer 1 Physical — raw bits, cables, voltage, PoE power delivery. Sandra's dead phone starts here — no PoE, no power, nothing above matters. Layer 2 Data Link — frames, MAC addresses, switches, VLANs, Spanning Tree. Marcus's trunk misconfiguration lives here. Layer 3 Network — IP addresses and routing. Layer 4 Transport — TCP and UDP. Layer 5 Session — opening and managing connections. Layer 6 Presentation — encryption and compression. Layer 7 Application — HTTP, DNS, email, VoIP signalling. Mnemonic bottom to top: Please Do Not Throw Sausage Pizza Away.

Each layer wraps data in its own unit called a PDU — Protocol Data Unit. Layer 1: Bits. Layer 2: Frames — includes MAC addresses and the FCS checksum. Layer 3: Packets — includes the IP header. Layer 4: Segments for TCP, Datagrams for UDP. Layers 5 through 7: simply Data. When Jamie examined the core switch, he was looking at Layer 2 frames being silently dropped. The trunk port was supposed to tag frames with VLAN IDs 20 and 30 and forward them upward. The STP error caused the switch to block that port entirely to prevent a broadcast loop.

Every device is defined by the highest layer it understands. The core switch in rack B operates at Layer 2 — forwarding frames by MAC address and VLAN tag. It caused the multi-floor outage. The access switch at Sandra's desk also operates at Layer 2, but its PoE port failed — a Layer 1 hardware issue underneath. The router connecting to Manchester operates at Layer 3 — it was fine, but the broken Layer 2 trunk meant no frames were reaching it. A hub operates at Layer 1 only — it blindly repeats electrical signals to all ports with no MAC awareness. Modern networks replaced hubs with switches for exactly that reason.

When Marcus's laptop tried to reach the shared drive, it began encapsulating data down the stack. The application layer produced an SMB request. Transport wrapped it in a TCP segment. Network added an IP packet with the server's destination address. Data Link wrapped that in an Ethernet frame tagged with VLAN 20 and sent it to the switch. The switch read the VLAN tag and tried to forward it up the trunk — but the misconfigured port blocked it. The frame never arrived. The laptop timed out and reported network path not found. Every layer above Layer 2 was working perfectly. One misconfiguration silenced an entire floor.

The TCP/IP model collapses OSI's seven layers into four practical ones. Network Access covers OSI Layers 1 and 2 — this is where both of today's faults live: the PoE failure and the VLAN trunk misconfiguration. Internet covers OSI Layer 3 — IP addressing and routing. Transport covers OSI Layer 4 — TCP and UDP. Application covers OSI Layers 5 through 7 — HTTP, DNS, email, VoIP signalling. When a vendor says Network Access layer, they mean anything from physical cabling to VLAN switching. When they say Application layer, they mean the protocol your software actually speaks.

The trunk misconfiguration disrupted Ethernet frame handling for VLANs 20 and 30. A frame contains: a Preamble (7 bytes) to synchronise clocks; an SFD (1 byte) marking the start; Destination and Source MAC addresses (6 bytes each); an EtherType field (2 bytes) — 0x8100 for an 802.1Q VLAN-tagged frame; the VLAN tag (4 bytes) carrying the VLAN ID; the Payload (up to 1500 bytes); and an FCS checksum (4 bytes). The trunk port was supposed to read the VLAN tag and forward accordingly. STP blocked it before that could happen. Jamie reverted the trunk config and cleared the STP error — both floors came back within 90 seconds.

Both incidents revolve around IPv4 address space. IPv4 originally used classful addressing — five classes splitting the 32-bit space by leading bits. Class A (1–126): default mask /8, up to 16 million hosts. Class B (128–191): default mask /16, ~65,000 hosts. Class C (192–223): default mask /24, 254 hosts — exactly what the warehouse was using. Class D (224–239): multicast only. Class E (240–255): experimental, never assigned. Mnemonic: Awful Big Companies Do not Exist. The warehouse was a textbook Class C — 254 usable addresses, a hard ceiling that became a crisis after a 40-scanner expansion.

Both sites use private IP addressing defined by RFC 1918 — three non-routable ranges any organisation can use internally. 10.0.0.0/8: over 16 million addresses for large enterprise networks. 172.16.0.0/12: covers 172.16.x.x through 172.31.x.x — about one million addresses. 192.168.0.0/16: 65,536 addresses — what the warehouse and Tom's home router both use. None are reachable from the internet directly. NAT at the router translates private IPs to a single public IP for outbound traffic. When Tom's router hung, DHCP stopped responding and his laptop fell back to APIPA.

Tom's 169.254.x.x address is the clearest diagnostic signal in today's tickets. That range is APIPA — Automatic Private IP Addressing. When a device sends a DHCP Discover and receives no reply, it self-assigns a 169.254.0.0/16 address so it can communicate locally only — no gateway, no internet. Other reserved addresses to know cold: 127.0.0.1 — loopback, tests the local TCP/IP stack without hitting the network. 0.0.0.0/0 — the default route, the catch-all for unmatched destinations in a routing table. 255.255.255.255 — limited broadcast, reaches all hosts on the local segment and is never forwarded by a router. Seeing 169.254 is almost always a DHCP failure, never a VPN or application fault.

Priya expanded the warehouse from /24 to /23. CIDR — Classless Inter-Domain Routing — expresses subnet masks as a prefix length: the count of 1-bits. The usable host formula is 2 to the power of host bits, minus 2. A /24 has 8 host bits: 256 minus 2 = 254 usable hosts. A /23 has 9 host bits: 512 minus 2 = 510 usable hosts. Moving from /24 to /23 borrowed one bit from the network portion and doubled the space. Quick reference — /25: 126, /26: 62, /27: 30, /28: 14, /29: 6, /30: 2 hosts for point-to-point links, /31: router-to-router only, /32: single host.

VLSM — Variable Length Subnet Masking — allows different subnets in the same address block to use different prefix lengths. The warehouse now uses /23. Office floors use /24. Router-to-router links use /30. The server VLAN uses /25. All carved from the same 10.0.0.0/8 corporate block. Without VLSM you would assign a /23 to a two-device router link and waste 508 addresses. VLSM requires a classless routing protocol — OSPF, EIGRP, or BGP — that advertises the prefix length alongside each route so every router knows exactly which addresses belong where.

Every private address in the warehouse and Tom's home reaches the internet via NAT — Network Address Translation. Static NAT: one-to-one permanent mapping — for servers that must always be reachable at the same public IP. Dynamic NAT: maps a private IP to a pool of public IPs on demand. PAT — Port Address Translation, also called NAT Overload: maps many private IPs to a single public IP using unique port numbers. The router's NAT translation table records every connection as private-IP:port mapped to public-IP:port. When the reply arrives, the router looks up the table and delivers it to the right host. When Tom's router hung, NAT stopped too — meaning even static-IP devices lost internet access alongside the DHCP failure.

When you design a network, the first decision is its topology — the logical and physical shape of how devices connect. The main types you need to know for the exam are these. A star (also called hub-and-spoke) topology connects every device to a central switch. This is the dominant topology inside any floor of a building — every workstation plugs into a switch. A mesh topology connects every device to every other device, providing maximum redundancy. Full mesh is expensive but used in WAN core links between critical sites. A hybrid topology combines multiple types — for example, a star inside each building connected to other buildings via a partial mesh. A point-to-point topology is a direct dedicated link between exactly two devices — the link connecting our new building to each satellite office will be point-to-point. Spine and leaf is a modern data-centre topology where every leaf switch connects to every spine switch, creating a predictable two-hop path between any two servers with no Spanning Tree dependency.

Claire's four-floor building is the perfect fit for the three-tier hierarchical model — the standard enterprise campus architecture. The three tiers are Core, Distribution, and Access. The Access layer is where end devices plug in — workstations, phones, printers, and wireless access points all connect to access-layer switches on each floor. These are the switches in the comms rooms on floors one and two. The Distribution layer aggregates traffic from all the access-layer switches on a floor or across a building and applies policies — routing, VLANs, and access control lists live here. The distribution switches connect upward to the core. The Core layer is the high-speed backbone that ties everything together — it carries traffic between distribution switches and out to the WAN. It must be fast and simple: no complex policies, just fast forwarding. For a smaller building, the core and distribution functions are often merged into a single pair of switches — this is called a collapsed core design.

Understanding how traffic moves through a network determines how you size and place your links. Two terms describe the two dominant flow directions. North-south traffic moves between clients inside the network and resources outside it — a user's laptop sending a request to an internet server, or a branch office communicating with a cloud application. This traffic crosses the core and exits through the WAN or internet edge. East-west traffic moves laterally between devices inside the same network — a web server talking to a database server, or one virtual machine communicating with another in the same data centre. In modern cloud-native architectures, east-west traffic now vastly outweighs north-south traffic in terms of volume. The spine-and-leaf topology was specifically designed to handle east-west traffic efficiently because every leaf can reach every other leaf in exactly two hops through a spine switch, regardless of scale.

For runs from each comms room to each desk — up to 100 metres — we will use copper twisted pair cable. The twisting of the wire pairs reduces crosstalk — electromagnetic interference between adjacent pairs — and protects against external interference. The standard for most modern office builds is Category 6, or Cat 6, which supports 10 Gbps up to 55 metres and 1 Gbps to the full 100 metres. Cat 6A extends 10 Gbps to the full 100 metres. Cat 7 and Cat 8 are shielded variants rated for data-centre use — Cat 8 supports 25 and 40 Gbps over shorter runs. Where the cable runs through air-handling spaces above suspended ceilings, we must use plenum-rated cable — standard PVC cables emit toxic fumes if they burn, while plenum-rated jackets are fire-resistant. All copper runs terminate at both ends with an RJ45 connector — the standard eight-pin modular connector used for Ethernet. For telephone lines, you will see the smaller four-pin RJ11.

The 280-metre run from the ground-floor comms room to the third-floor server room exceeds copper's 100-metre limit, so we will use optical fibre — cable that carries light rather than electrical signals, making it immune to electromagnetic interference and capable of much longer distances. There are two types. Multimode fibre has a larger core diameter — typically 50 or 62.5 microns — and uses cheaper LED light sources. It supports runs up to about 550 metres at 10 Gbps. It is the right choice for within-building backbone runs. Single-mode fibre has a much smaller core — typically 9 microns — and uses laser light sources. It supports runs of many kilometres, making it the only viable choice for the 12-mile satellite office links. The common fibre connectors are: LC (Local Connector) — small form-factor, the most common in data centres today. SC (Subscriber Connector) — square push-pull, common in older installations. ST (Straight Tip) — bayonet-style twist-lock, found in legacy environments. MPO (Multi-fibre Push On) — carries multiple fibres in one connector, used for high-density patch panels.

Where fibre connects into a switch or router, the device uses a transceiver — a removable module that converts between optical and electrical signals. The modular design means you can upgrade a port from one speed to another by swapping the transceiver rather than replacing the entire switch. The two main form factors are SFP (Small Form-factor Pluggable), which handles speeds from 1 Gbps to 10 Gbps, and QSFP (Quad Small Form-factor Pluggable), which handles 40 Gbps and above by running four lanes simultaneously. For very short connections between adjacent switches in the same rack — say, a spine switch to a leaf switch directly above it — Direct Attach Copper, or DAC cable, is often used instead of fibre. DAC uses a twinaxial cable — two conductors sharing a common shield — with SFP or QSFP transceivers pre-attached at each end. It is cheaper and lower-latency than fibre for rack-scale distances up to about seven metres.

Floors one and two need wireless coverage for mobile devices. Wireless networking uses the 802.11 family of standards — each generation increases speed and efficiency. 802.11ac (Wi-Fi 5) operates on the 5 GHz band and delivers up to several Gbps using multiple antennas. 802.11ax (Wi-Fi 6 and 6E) improves efficiency in dense environments — office floors with hundreds of devices — using OFDMA to serve multiple clients simultaneously. Wi-Fi 6E extends into the 6 GHz band, giving more spectrum free from legacy interference. Wireless also relies on the concept of channels — specific frequency slices within a band. On 2.4 GHz, only three channels are non-overlapping: 1, 6, and 11. On 5 GHz and 6 GHz, many more non-overlapping channels are available, which is why dense environments prefer these bands. For WAN links to the satellite offices where leased fibre is not feasible, cellular connections (4G LTE or 5G) or satellite internet (useful for truly remote sites) can provide backup or primary WAN connectivity.

The three foundational devices in any server room start with the router — which connects different networks together and makes forwarding decisions based on IP addresses at Layer 3. The router sits at the boundary between the internal network and the outside world, and between VLANs internally when inter-VLAN routing is needed. Above it in the rack, or alongside it, sits the firewall — which inspects traffic and permits or denies it based on rules. A basic firewall works at Layers 3 and 4, matching on IP address and port number. A Next-Generation Firewall (NGFW) can inspect all the way to Layer 7, reading the actual application content of traffic — identifying whether a connection on port 443 is legitimate HTTPS or a tunnelled command-and-control session. An IDS (Intrusion Detection System) monitors traffic and raises alerts when it detects suspicious patterns, but takes no action itself. An IPS (Intrusion Prevention System) goes further — it sits inline in the traffic path and can actively block traffic that matches an attack signature in real time.

As the company grows and runs multiple web servers, a load balancer becomes essential. A load balancer sits in front of a group of servers and distributes incoming client requests across them, ensuring no single server is overwhelmed while the others sit idle. A Layer 4 load balancer works at the Transport layer — it distributes connections based on TCP or UDP without reading the content. A Layer 7 load balancer works at the Application layer — it reads HTTP headers and can make smarter decisions, routing requests for different URLs to different server pools, or sending a particular user's session consistently to the same server for session persistence. A proxy sits between clients and servers, making requests on behalf of clients. A forward proxy serves clients — used to enforce browsing policies, cache content, and anonymise internal IP addresses. A reverse proxy sits in front of servers — used to offload SSL termination, cache static content, and protect origin servers from direct internet exposure.

For shared file storage, the server room will house either a NAS (Network-Attached Storage) or a SAN (Storage Area Network). A NAS connects to the standard Ethernet network and presents storage as shared folders — simple to deploy and manage, suitable for general file sharing. A SAN is a dedicated, high-speed private network built specifically for storage traffic, using protocols like Fibre Channel or iSCSI. It presents storage to servers as if it were a locally attached disk — used for databases and applications that need the lowest possible latency. For wireless management across a large building, a wireless controller centrally manages all the access points — pushing configurations, monitoring for rogue devices, and coordinating roaming as users move between floors. Finally, three important network functions: VPN (Virtual Private Network) creates an encrypted tunnel over a public network — used to connect the satellite offices securely. QoS (Quality of Service) prioritises certain traffic types — ensuring VoIP calls are not degraded by a large file download happening at the same time. TTL (Time to Live) is a counter in every IP packet that decrements by one at each router hop — when it reaches zero the packet is discarded, preventing routing loops from circulating packets indefinitely.

The final appliance category in objective 1.2 is not a physical device but a service: the CDN — Content Delivery Network. A CDN is a geographically distributed network of servers that caches copies of content — images, videos, scripts, and static web pages — close to end users. When a user in Manchester requests content from a website hosted in California, a CDN serves the cached copy from a server in the United Kingdom instead of routing the request across the Atlantic. This dramatically reduces latency and takes load off the origin server. Major CDN providers include Cloudflare, Akamai, and Amazon CloudFront. For this building, if the company hosts a public-facing website or delivers large media files to customers, fronting it with a CDN is a straightforward performance and resilience improvement that does not require any changes to the internal network.

Priya's ticket names exactly the ports the exam tests. Every service communicates on a numbered port — the port tells the operating system which application should receive incoming data. You need to know these cold. FTP uses ports 20 and 21 — port 21 for control commands, port 20 for data transfer. SSH uses port 22 — encrypted remote shell access and secure file transfer via SFTP. Telnet uses port 23 — unencrypted remote shell, never use in production. SMTP uses port 25 — sending email between mail servers. DNS uses port 53 — name resolution, both UDP for queries and TCP for zone transfers. DHCP uses ports 67 and 68 — the server listens on 67, clients broadcast to 68. HTTP uses port 80. HTTPS uses port 443 — HTTP encrypted with TLS. SMB uses port 445 — Windows file and printer sharing. RDP uses port 3389 — Remote Desktop Protocol for graphical remote access to Windows. SIP uses ports 5060 and 5061 — Session Initiation Protocol for VoIP call setup.

Gemma's monitoring failures each map to a specific protocol and port. SNMP — Simple Network Management Protocol — uses UDP ports 161 and 162. Devices respond to polling on port 161. They send unsolicited alerts called traps to the management station on port 162. Syslog uses UDP port 514 — devices send text log messages to a central syslog collector. NTP — Network Time Protocol — uses UDP port 123 to synchronise clocks across all devices. Accurate time is critical for log correlation, certificate validation, and authentication protocols. Other management protocols worth knowing: LDAP (port 389) and LDAPS (port 636) — directory services, used for user authentication against Active Directory. TFTP (port 69) — Trivial File Transfer Protocol, used for transferring device firmware and configuration files with no authentication overhead. SMTPS (port 587) — encrypted email submission. SQL Server listens on port 1433.

Below the port number level, IP carries different protocol types identified by a number in the IP header. TCP (Transmission Control Protocol) is connection-oriented — it establishes a session using a three-way handshake, guarantees delivery through acknowledgements, and retransmits lost data. It is the right choice where accuracy matters: HTTP, HTTPS, FTP, SSH, SMTP. UDP (User Datagram Protocol) is connectionless — it fires packets with no handshake, no acknowledgements, and no retransmission. It is faster and lower-latency, making it right for real-time traffic where a late packet is useless: VoIP, video streaming, DNS queries, DHCP, NTP, SNMP. ICMP (Internet Control Message Protocol) carries diagnostic and control messages — ping uses ICMP echo request and echo reply. GRE (Generic Routing Encapsulation) wraps packets inside other packets, used to create tunnels. IPSec provides encryption and authentication for IP traffic using three components: AH (Authentication Header) for integrity, ESP (Encapsulating Security Payload) for encryption, and IKE (Internet Key Exchange) to negotiate the encryption keys.

Beyond protocols and ports, IP traffic is also classified by how it is addressed and delivered — these are the four traffic types. Unicast is a one-to-one transmission from one source to one specific destination — the vast majority of internet traffic is unicast. Broadcast is a one-to-all transmission within a network segment — DHCP Discover and ARP requests are broadcast traffic. Routers do not forward broadcasts, which is why each subnet is its own broadcast domain. Multicast is a one-to-many transmission but only to devices that have joined a specific multicast group — used for streaming video, routing protocol updates like OSPF, and IPTV. Multicast is more efficient than broadcast because only interested receivers process the traffic. Anycast is a one-to-nearest transmission — a single IP address is announced from multiple locations and the network routes each request to the geographically or topologically closest instance. DNS root servers and CDN edge nodes use anycast extensively.

Before choosing a cloud provider, the board needs to understand what they are actually buying. Cloud services are sold in three layers. IaaS — Infrastructure as a Service — the provider supplies virtual machines, storage, and networking. You control the operating system, applications, and data. You are still responsible for patching, security hardening, and configuration. AWS EC2, Azure VMs, and Google Compute Engine are IaaS. PaaS — Platform as a Service — the provider manages the infrastructure and the runtime environment. You supply only the application code and data. AWS Elastic Beanstalk, Azure App Service, and Google App Engine are PaaS. SaaS — Software as a Service — the provider manages everything including the application. You simply use it through a browser. Microsoft 365, Salesforce, and Google Workspace are SaaS. The higher up the stack you go, the less you manage — but also the less control you have.

The second dimension of the cloud decision is the deployment model — who else shares the infrastructure. A public cloud is a shared environment — your virtual machines run on hardware that also hosts other customers' workloads, separated by virtualisation. This gives maximum scalability and the lowest cost, but means placing trust in the provider's isolation guarantees. A private cloud is dedicated infrastructure — either hosted in your own data centre (on-premises private cloud) or in a provider's facility but dedicated exclusively to your organisation. It gives more control but costs more. A hybrid cloud combines both — sensitive workloads or data that must stay on-premises for regulatory reasons remain in the private environment, while scalable or less sensitive workloads run in the public cloud. The two environments are connected via VPN or dedicated links. Three cloud properties underpin all models: scalability — the ability to grow capacity to meet demand; elasticity — the ability to scale up and down automatically based on real-time demand; and multitenancy — multiple customers sharing the same physical infrastructure while remaining isolated from each other.

When you deploy to a public cloud, your resources do not simply appear on the provider's shared internet — they live inside a VPC, Virtual Private Cloud. A VPC is a logically isolated section of the cloud provider's network that you control. You define the IP address ranges, create subnets, configure routing tables, and control what can reach the internet and what cannot. Think of it as your own private data-centre network, but hosted in the provider's infrastructure. Within a VPC, you control traffic using two mechanisms. Network Security Groups are stateful firewalls attached to individual virtual machine interfaces — you define inbound and outbound rules by port and source address, and the group remembers the state of connections so return traffic is automatically permitted. Network Security Lists (or Network ACLs in AWS) are stateless rules applied at the subnet level — both inbound and outbound rules must be explicitly defined for every connection because there is no state tracking. Cloud gateways control how traffic enters and exits the VPC: an internet gateway allows resources with public IPs to communicate with the internet, while a NAT gateway allows private resources to initiate outbound internet connections without exposing a public IP.

Claire's offices need a secure, reliable connection to the VPC — there are two main options. A VPN connection creates an encrypted IPSec tunnel over the public internet from our on-premises router to a virtual gateway at the cloud provider's edge. It is quick to set up and costs very little, but performance depends on the quality of the internet connection and it shares bandwidth with general internet traffic. Direct Connect (in AWS) or its equivalent from other providers — Azure ExpressRoute, Google Cloud Interconnect — is a dedicated private circuit from your premises to the cloud provider's facility. It bypasses the public internet entirely, giving consistent latency, higher bandwidth, and typically stronger compliance positioning for regulated data. Also relevant here is NFV — Network Functions Virtualisation — the practice of running network functions that traditionally required dedicated hardware appliances — firewalls, load balancers, routers — as software on standard virtual machines in the cloud. NFV gives you the ability to spin up a virtual firewall in minutes rather than racking a physical appliance.

Software-Defined Networking, or SDN, separates the control plane from the data plane. Traditionally, each switch and router makes its own forwarding decisions independently — the control plane (the intelligence) and the data plane (the actual packet forwarding) live inside the same box. SDN centralises the control plane into a software controller that has a global view of the network, pushing forwarding rules down to dumb forwarding devices. This enables application-aware routing — the controller can see that a video conferencing stream needs priority treatment and instruct the network to treat it accordingly across the whole path. Zero-touch provisioning means a new device can connect, download its configuration from the controller automatically, and be production-ready without a human manually configuring it. Transport-agnostic means the overlay network runs over whatever underlay connectivity is available — MPLS, broadband, 4G — without caring about the physical medium. SD-WAN applies these SDN principles specifically to WAN links, allowing intelligent traffic steering across multiple connection types simultaneously. Instead of a rigid expensive MPLS circuit to each satellite office, SD-WAN can combine a broadband link, an LTE backup, and a cloud VPN — routing business-critical traffic over the most reliable path and less-critical traffic over the cheapest.

VXLAN — Virtual Extensible LAN — solves a specific problem in large-scale virtualised environments. Traditional VLANs are limited to 4,094 IDs — in a large data centre or cloud provider running tens of thousands of tenant workloads, this is not nearly enough. VXLAN extends this to over 16 million logical network IDs. It works by encapsulating Layer 2 Ethernet frames inside UDP packets — this is called Layer 2 encapsulation. The encapsulated frames can then travel across a Layer 3 IP fabric to anywhere in the data centre or across a WAN link — this is called Data Centre Interconnect, or DCI. VXLAN creates virtual overlay networks that are completely decoupled from the physical underlay network. From a virtual machine's perspective, it appears to be on a local Ethernet segment even though the physical server it is running on may be in a different rack, building, or geography from the virtual machine it is communicating with.

Zero Trust Architecture, or ZTA, is a security model built on a single principle: never trust, always verify. Traditional network security assumes that anyone inside the network perimeter can be trusted. Zero trust rejects that assumption entirely — every user, device, and application must be verified before being granted access to any resource, regardless of where they are connecting from. Zero trust implements this through three mechanisms. Policy-based authentication means access decisions are driven by dynamic policy — considering the user's identity, device health, location, and the sensitivity of the resource being requested. Authorisation is granted per request, not per network connection — being on the corporate network does not grant access to anything by default. Least privilege access means each user or system receives only the minimum permissions required to perform its specific function. SASE — Secure Access Service Edge — takes the zero-trust model and delivers it as a cloud service, combining SD-WAN connectivity with cloud-hosted security functions (firewall, proxy, zero trust network access) in a single integrated platform. SSE — Security Service Edge — is the security-only component of SASE, without the SD-WAN element.

Infrastructure as Code, or IaC, is the practice of defining and managing network and compute infrastructure through code rather than manual configuration. Instead of a network engineer SSHing into each switch and typing commands, the desired state of the network is described in a configuration file — and an automation tool applies that configuration consistently across every device. The key components: Playbooks and templates define reusable configuration tasks — a playbook might describe how to configure a new VLAN across all switches in a building. Configuration drift detection continuously compares the live running configuration of each device against the intended baseline and alerts when they diverge. Source control means all configuration files are stored in a version control system like Git. This provides a central repository where all changes are tracked, every version is recoverable, and conflicts between competing changes are identified before they reach production. Branching allows teams to develop and test configuration changes in an isolated copy before merging them into the main configuration.

IPv4's 4.3 billion addresses were exhausted at the regional registry level years ago. IPv6 solves this with a 128-bit address space — 340 undecillion addresses, enough for every grain of sand on Earth to have its own IP address many times over. An IPv6 address is written as eight groups of four hexadecimal digits separated by colons — for example, two-zero-zero-one, colon, zero-D-B-eight, and so on. Leading zeros within a group can be omitted, and one consecutive run of all-zero groups can be compressed to a double colon. IPv6 eliminates broadcast entirely — it uses multicast and a new protocol called Neighbour Discovery Protocol to replace ARP. Devices can self-configure their own IPv6 addresses using SLAAC — Stateless Address Autoconfiguration, without needing a DHCP server. For the transition period — which is still ongoing — three coexistence mechanisms exist. Dual stack runs IPv4 and IPv6 simultaneously on every device. Tunneling encapsulates IPv6 packets inside IPv4 packets to cross IPv4-only infrastructure. NAT64 allows IPv6-only clients to communicate with IPv4-only servers by translating between the two address families at a gateway.