6.1.1. Problem Identification and Theory

Step 1: Identify the Problem

• Gather information from users and systems
• Question users about changes, symptoms, scope
• Determine: Is it one user, one department, or everyone? Look for what the affected users share (same VLAN, switch, building area, or start time)—a common factor points to a common cause.
• Ask: What changed? When did it start?
• Duplicate the problem if possible
• Address multiple problems individually

⚠️ Exam Trap: The FIRST step is always "Identify the problem." Questions asking "what should you do first" almost always have this answer—not "reboot the device" or "check the cable."

Step 2: Establish a Theory

• Question the obvious first: check simple causes and recent changes (such as a configuration change made last night) before exotic theories
• Consider multiple approaches:
  • Bottom-to-top: Start at Layer 1, work up (cable → switch → router → application)—best when hardware could be at fault or the symptoms are vague
  • Top-to-bottom: Start at Layer 7, work down—best when the symptom is a specific application error
  • Divide and conquer: Test middle layer first, then go up or down based on results