# IT Engineer

# Interview Cheat Sheet

- Scope: Who is affected?
- Impact: How severe is it?
- Change: What changed recently?
- Authentication: How do they login?
- Connectivity: Can they reach the service?
- Service Health: Is the service actually running?
- Evidence: What do logs show?
- Fix: Implement one change at a time.
- Verify: Confirm restoration.
- Document: Record root cause and resolution.

#### Scenario 1: User unable to log into Microsoft 365

- What is the error message?
- Is anyone else impacted?
- Did you recently change your password?
- Where are you connecting from?
- Is this the first time you have seen this error? when did it start?
- When was the last time you were able to successfully log in? Have you returned from a break?

# Microsoft Entra

Entra ID

- Cloud based identity and access management service that provides authentication, policy enforcement, and protection for users, devices, apps, and resources

#### Identity & Access Management (IAM)

- Ensures that the right people, machines and software components access the right resouces at the right time

#### Entra Domain Services

- Two Windows Server Domain Controllers are deployed as part of a replica set
- These are fully managed by Microsoft and handles availability, backups and encyption
- A managed domain is configured to perform a one-way synchronisation from Microsoft Entra ID
- Users, groups and credentials from Entra ID are made available in the managed domain so that applications, services and VMs in Azure can use familiar AD DS capabilities such as domain join, GPO, LDAP, and Kerberoes/NTLM authentication
- In hybrid environments, identity information from on-prem AD DS is synchronised to Microsoft Entra ID, and then made available to the managed domain
- Domain services works with both cloud-only Microsoft Entra tenants, and tenants synchronised with an on-prem AD DS environment

# Network Devices

#### Cisco Devices

Modes:

- > User (basic access)
- \# Priviledged (run show commands)
- (config)# (config changes)

<table id="bkmrk-s1%3E-enable-s1%23-confi" style="border-collapse:collapse;width:100%;"><colgroup><col style="width:50.0596%;"></col><col style="width:50.0596%;"></col></colgroup><tbody><tr><td>S1&gt; enable</td><td>  
</td></tr><tr><td>S1# configure terminal</td><td>  
</td></tr><tr><td>S1(config)# vlan 10</td><td>  
</td></tr><tr><td>S1(config-vlan)# name SALES</td><td>  
</td></tr><tr><td>S1(config-vlan)# exit</td><td>  
</td></tr><tr><td>S1(config)# end</td><td>  
</td></tr><tr><td>S1#</td><td>  
</td></tr><tr><td>S1# show vlan</td><td>  
</td></tr><tr><td>R1# show run</td><td>  
</td></tr><tr><td>S1# show ip interface brief

</td><td>  
</td></tr><tr><td>S1# show interfaces</td><td>  
</td></tr></tbody></table>

- Device configuration such as hostname is stored in running config
- To save, "copy running-config startup-config"

#### ICMP PDU (Ping Simulation)

##### PC (Office Admin) &gt; SW (Office SW1) &gt; Printer0

**1. Last: (Blank), At: Office-Admin (ICMP)**

- Outbound: 
    - Layer 3: 
        - ICMP echo request
        - Source IP = unspecified, device sets to port's IP
        - Destination IP in same subnet, device sets next hop to destination IP
    - Layer 2: 
        - Next hop = unicast, looks it up in ARP table
        - Found in ARP, ARP process sets frame destination accordingly
    - Layer 1: 
        - FastEthernet0 sends the Frame

**2. Last: Office-Admin, At: Office-SW1 (ICMP)**

- Inbound: 
    - Layer 1: 
        - Receives Frame
    - Layer 2: 
        - Frame source MAC address not in MAC table, adds it
        - (Unicast Frame) look up Destination MAC address in MAC table
- Outbound: 
    - Layer 2: 
        - Not in table, Floods frame to all ports in VLAN except inbound
    - Layer 1: 
        - Ports 1, 2, 3, 4, 5, 6 send Frame

**3. Last: Office-SW1, At: Office-R1 (ICMP)**

- Inbound: 
    - Layer 1: 
        - Receives Frame on G0/0/0
    - Layer 2: 
        - Subinterface G0/0/0.20 accepts from this VLAN
        - Frame destination MAC does not match receiving port's MAC
        - Drops the Frame

**4. Last: Office-SW1, At: Printer0 (ICMP)**

- Inbund: 
    - Layer 1: 
        - Receives Frame on FE0
    - Layer 2: 
        - Frame Destination MAC = receiving port's MAC
        - De-capsulate PDU from the Frame
    - Layer 3: 
        - Packet Destination IP = Device Destination IP
        - De-capsulate Packet, identifies ICMP, processes it
        - Identifies as Echo request message
- Outbound: 
    - Layer 3: 
        - ICMP process sends Echo reply
        - Destination IP = same subnet, sets next hop to Destination IP
    - Layer 2: 
        - Next hop = unicast, looks it up in ARP table
        - Found in ARP, ARP sets Frame desination MAC to the same
        - Encapsulates PDU into Frame
    - Layer 1: 
        - FE0 sends Frame

**5. Last: Printer0, At: Office-SW1 (ICMP)**

- Inbound: 
    - Layer 1: 
        - GE1/0/17 Receives Frame
    - Layer 2: 
        - Frame source MAC is not in MAC table, adds it
        - Unicast Frame, looks up destination MAC in table
- Outbound: 
    - Layer 2: 
        - Outgoing port = access port
        - Switch sends the frame out of that port
    - Layer 1: 
        - GE1/0/19 sends the Frame

**6. Last: Office-SW1, At: Office-Admin (ICMP)**

- Inbound: 
    - Layer 1: FE0 Receives Frame
    - Layer 2: 
        - Frame destination MAC = Receiving port MAC
        - Decapsulates Frame
    - Layer 3: 
        - Packet destination IP = device IP
        - decapsulates Packet
        - Identifies ICMP Packet
        - ICMP process received Echo reply message

# Scenario 1: User Cannot Log into M365

A user calls saying they cannot access outlook, teams or sharepoint. They receive a login error

- What is the error message?
- Is anyone else impacted?
- Did you recently change your password?
- Where are you connecting from?
- Is this the first time you have seen this error? when did it start?
- When was the last time you were able to successfully log in? Have you returned from a break?

# Network Subnetting

#### Cheat Sheet

<table id="bkmrk-group-size-128-64-32" style="border-collapse:collapse;width:100%;"><colgroup><col style="width:11.7989%;"></col><col style="width:10.3703%;"></col><col style="width:11.0846%;"></col><col style="width:11.0846%;"></col><col style="width:11.0846%;"></col><col style="width:11.0846%;"></col><col style="width:11.0846%;"></col><col style="width:11.0846%;"></col><col style="width:11.0846%;"></col></colgroup><tbody><tr><td>Group Size</td><td>**128**</td><td>**64**</td><td>**32**</td><td>**16**</td><td>**8**</td><td>**4**</td><td>**2**</td><td>**1**</td></tr><tr><td>Subnet</td><td>**128**</td><td>**192**</td><td>**224**</td><td>**240**</td><td>**248**</td><td>**252**</td><td>**254**</td><td>**255**</td></tr><tr><td>CIDR (4o)</td><td>/25</td><td>/26</td><td>/27</td><td>/28</td><td>/29</td><td>/30</td><td>/31</td><td>/32</td></tr><tr><td>3rd octet</td><td>/17</td><td>/18</td><td>/19</td><td>/20</td><td>/21</td><td>/22</td><td>/23</td><td>/24</td></tr><tr><td>2nd octet</td><td>/9</td><td>/10</td><td>/11</td><td>/12</td><td>/13</td><td>/14</td><td>/15</td><td>/16</td></tr><tr><td>1st octet</td><td>/1</td><td>/2</td><td>/3</td><td>/4</td><td>/5</td><td>/6</td><td>/7</td><td>/8</td></tr></tbody></table>

1. Use CIDR/Mask to find group size above
2. Starting from 0, or the corresponding subnet value above, or one to its left, increase or decrease by the group size, until you pass the corresponding octet value in the target IP 
    1. Next Network ID cannot contain 256, instead increment the preceding octet by 1 and reset to 0
    2. If this is the 1st octet, Next Network is N/A, and Broadcast IP = 255.255.255.255
3. Number before target IP = Network ID
4. First Host = Network ID + 1
5. Number after target IP = Next Network ID
6. Broadcast = Next Network - 1
7. Last Host = Next Network - 2
8. \#IP Addresses = Group size, or 2<sup>(32-CIDR) </sup>for 3rd/4th octet

<table id="bkmrk-network-id-first-hos" style="border-collapse:collapse;width:37.381%;"><colgroup><col style="width:50%;"></col><col style="width:50%;"></col></colgroup><tbody><tr><td>Network ID</td><td>  
</td></tr><tr><td>First Host IP</td><td>  
</td></tr><tr><td>Last Host IP</td><td>  
</td></tr><tr><td>Broadcast IP</td><td>  
</td></tr><tr><td>Next Network ID</td><td>  
</td></tr><tr><td>No. IP Addresses</td><td>  
</td></tr><tr><td>CIDR/Subnet Mask</td><td>  
</td></tr></tbody></table>

- East subnet bit doubles the available subnets
- Each host bit doubles the available host addresses

#### FLSM Questions

<table id="bkmrk-21-2-22-4-23-8-24-16" style="border-collapse:collapse;width:10.119%;height:308.417px;"><colgroup><col style="width:39.3939%;"></col><col style="width:60.6061%;"></col></colgroup><tbody><tr style="height:31.8833px;"><td style="height:31.8833px;">2<sup>1</sup></td><td style="height:31.8833px;">2</td></tr><tr style="height:31.8833px;"><td style="height:31.8833px;">2<sup>2</sup></td><td style="height:31.8833px;">4</td></tr><tr style="height:31.8833px;"><td style="height:31.8833px;">2<sup>3</sup></td><td style="height:31.8833px;">8</td></tr><tr style="height:31.8833px;"><td style="height:31.8833px;">2<sup>4</sup></td><td style="height:31.8833px;">16</td></tr><tr style="height:31.8833px;"><td style="height:31.8833px;">2<sup>5</sup></td><td style="height:31.8833px;">32</td></tr><tr style="height:29.8px;"><td style="height:29.8px;">2<sup>6</sup></td><td style="height:29.8px;">64</td></tr><tr style="height:29.8px;"><td style="height:29.8px;">2<sup>7</sup></td><td style="height:29.8px;">128</td></tr><tr style="height:29.8px;"><td style="height:29.8px;">2<sup>8</sup></td><td style="height:29.8px;">256</td></tr><tr style="height:29.8px;"><td style="height:29.8px;">2<sup>9</sup></td><td style="height:29.8px;">512</td></tr></tbody></table>

Starting with /18, what size sub-network would you need to create 100 sub-networks? <span style="background-color:rgb(255,255,255);color:rgb(224,62,45);">/25</span>

- <span style="background-color:rgb(255,255,255);color:rgb(0,0,0);">Or, 128 = 2<span style="color:rgb(224,62,45);"><sup>7 </sup>/18 + 7 = /25</span></span>

[![image.png](https://note.human-bean.net/uploads/images/gallery/2026-07/scaled-1680-/2dGimage.png)](https://note.human-bean.net/uploads/images/gallery/2026-07/2dGimage.png)

Starting with /21, how many sub-networks could you create that could contain 50 IP addresses? <span style="color:rgb(224,62,45);">32</span>

- <span style="color:rgb(0,0,0);">Or, <span style="color:rgb(224,62,45);">/26 - /20</span> = 2<span style="color:rgb(224,62,45);"><sup>5</sup></span> = 32</span>

[![image.png](https://note.human-bean.net/uploads/images/gallery/2026-07/scaled-1680-/xQqimage.png)](https://note.human-bean.net/uploads/images/gallery/2026-07/xQqimage.png)

[![image.png](https://note.human-bean.net/uploads/images/gallery/2026-07/scaled-1680-/e9ximage.png)](https://note.human-bean.net/uploads/images/gallery/2026-07/e9ximage.png)

#### How to Read a Subnetting Question

You will generally be given 2, and your job will be to solve the 3rd.

- A starting network size
- Number of Sub-Networks
- Size of Sun-Network

#### Variable Length Subnet Masks (VLSM)

[https://www.youtube.com/watch?v=amKyfbg5G2Q](https://www.youtube.com/watch?v=amKyfbg5G2Q)