WGU D412 | Network Analytics and Troubleshooting
PERFORMANCE ASSESSMENT
TASK 1
Network Troubleshooting and
Help Desk Ticket Analysis
WGU D412 - Network Analytics and Troubleshooting
Student Name: [Your Name]
Student ID: [Your Student ID]
Submission Date: [Month Day, Year]
Student Working Report | Page 1
,WGU D412 | Network Analytics and Troubleshooting
Submission Readiness Notice
Important: This is an editable working report, not fabricated lab evidence. Replace every bracketed
field and screenshot placeholder with results from your own assigned virtual lab. Confirm each
proposed root cause and command against the current task instructions. Delete this notice, all
orange lab-validation notes, and all unused instructional text before submission.
Evidence Capture Requirements
Use original screenshots from your own D412 lab session.
Capture the entire desktop; do not crop the terminal, browser, management console, taskbar,
or clock.
Make the local operating-system date and time legible in every identification and verification
image.
Show the command and its output or the relevant configuration panel; enlarge text before
capture if necessary.
Preserve one problem-state and one resolved-state image for each ticket unless the current
official template expressly requires more.
Remove all placeholder boxes and instructional text before submission.
Report Organization
Each ticket repeats the same evaluator-friendly sequence: evidence, root cause, tools, tool justification,
numbered troubleshooting process, corrective action, verification, prevention recommendation, and
client diagnostic questions. Part G consolidates the six tickets into a summary form.
Student Working Report | Page 2
,WGU D412 | Network Analytics and Troubleshooting
Help Desk Ticket 1: DNS Redirect and Hijack Anomaly
Scenario context: Users on USER_Net are redirected to an unrelated or suspicious website when
browsing to www.wgu.edu after recent work on DMZ_Server_3, the internal DNS server.
Lab-validation note: Do not assume whether the defect is an A record, zone, or forwarder until the
lab evidence identifies it.
A. Troubleshooting Network Documentation
A1. Screenshots of Identified Problem and Resolution
Figures 1A and 1B are reserved for the student’s original evidence. Replace both placeholders with
uncropped screenshots captured during the same lab attempt. Each screenshot must visibly connect the
displayed state to this ticket and include the local date and time.
A2. Root Cause Analysis
Confirmed root cause: [Confirm in your lab.] The internal DNS data on DMZ_Server_3 contained an
incorrect record or zone entry for www.wgu.edu, causing USER_Net clients to receive a rogue
destination address instead of the authoritative public address.
A2a. Tools Used
nslookup or Resolve-DnsName - compares the client response with the configured DNS server
and displays the returned address.
ipconfig /all and ipconfig /displaydns - confirms which DNS server the client uses and whether a
cached entry persists.
DNS Manager on DMZ_Server_3 - inspects forward lookup zones, host records, and forwarder
configuration.
ipconfig /flushdns followed by a browser or ping test - removes stale client cache and validates
the corrected lookup.
A2b. Tool Justification
DNS-specific tools were required because the symptom was name-dependent: the client could reach a
site, but the requested name produced the wrong destination. nslookup separates name resolution
from browser behavior, while DNS Manager exposes the authoritative internal record that can override
public DNS. Cache inspection and flushing distinguish a corrected server record from an old client-side
response.
A2c. Troubleshooting Process and Resolution
1. Reproduced the report from USER_Net and recorded the unexpected destination without entering
credentials or downloading content.
2. Ran ipconfig /all to confirm that the client was using DMZ_Server_3 for DNS.
Student Working Report | Page 3
, WGU D412 | Network Analytics and Troubleshooting
3. Queried www.wgu.edu with nslookup and recorded both the responding DNS server and returned IP
address.
4. Compared the result with an external or known-good resolution only as permitted by the lab,
establishing that the internal reply was inconsistent.
5. Opened DNS Manager on DMZ_Server_3 and inspected the relevant forward lookup zone, host
record, and forwarder entries.
6. Located the incorrect [A/zone/forwarder] entry and documented it before alteration.
7. Removed or corrected only the erroneous entry, then cleared the DNS server cache if required.
8. Flushed the USER_Net client resolver cache and repeated nslookup before reopening the site.
Corrective action: Correct the invalid DNS object on DMZ_Server_3 so www.wgu.edu is resolved
through an approved authoritative path. Record the exact record name, old value, new value, and
change time: [insert verified values].
Verification: A new nslookup query must show the approved DNS server and a legitimate destination,
and the browser must reach www.wgu.edu without redirection. The screenshot should show both the
successful result and system date/time.
B. Business Recommendation
Implement DNS change control, role-based administrative access, secure dynamic updates, DNS logging,
and automated monitoring for newly created or modified zones and high-risk records. Schedule periodic
comparison of internal responses with approved external resolvers and alert security staff when a
protected domain resolves unexpectedly.
Client Diagnostic Questions
When did the redirection first occur, and does it affect every USER_Net device?
Does the problem occur by hostname only, or also when using a known IP address?
Which DNS server is displayed on the affected client?
Did the user receive a certificate warning or enter credentials on the redirected page?
Student Working Report | Page 4
PERFORMANCE ASSESSMENT
TASK 1
Network Troubleshooting and
Help Desk Ticket Analysis
WGU D412 - Network Analytics and Troubleshooting
Student Name: [Your Name]
Student ID: [Your Student ID]
Submission Date: [Month Day, Year]
Student Working Report | Page 1
,WGU D412 | Network Analytics and Troubleshooting
Submission Readiness Notice
Important: This is an editable working report, not fabricated lab evidence. Replace every bracketed
field and screenshot placeholder with results from your own assigned virtual lab. Confirm each
proposed root cause and command against the current task instructions. Delete this notice, all
orange lab-validation notes, and all unused instructional text before submission.
Evidence Capture Requirements
Use original screenshots from your own D412 lab session.
Capture the entire desktop; do not crop the terminal, browser, management console, taskbar,
or clock.
Make the local operating-system date and time legible in every identification and verification
image.
Show the command and its output or the relevant configuration panel; enlarge text before
capture if necessary.
Preserve one problem-state and one resolved-state image for each ticket unless the current
official template expressly requires more.
Remove all placeholder boxes and instructional text before submission.
Report Organization
Each ticket repeats the same evaluator-friendly sequence: evidence, root cause, tools, tool justification,
numbered troubleshooting process, corrective action, verification, prevention recommendation, and
client diagnostic questions. Part G consolidates the six tickets into a summary form.
Student Working Report | Page 2
,WGU D412 | Network Analytics and Troubleshooting
Help Desk Ticket 1: DNS Redirect and Hijack Anomaly
Scenario context: Users on USER_Net are redirected to an unrelated or suspicious website when
browsing to www.wgu.edu after recent work on DMZ_Server_3, the internal DNS server.
Lab-validation note: Do not assume whether the defect is an A record, zone, or forwarder until the
lab evidence identifies it.
A. Troubleshooting Network Documentation
A1. Screenshots of Identified Problem and Resolution
Figures 1A and 1B are reserved for the student’s original evidence. Replace both placeholders with
uncropped screenshots captured during the same lab attempt. Each screenshot must visibly connect the
displayed state to this ticket and include the local date and time.
A2. Root Cause Analysis
Confirmed root cause: [Confirm in your lab.] The internal DNS data on DMZ_Server_3 contained an
incorrect record or zone entry for www.wgu.edu, causing USER_Net clients to receive a rogue
destination address instead of the authoritative public address.
A2a. Tools Used
nslookup or Resolve-DnsName - compares the client response with the configured DNS server
and displays the returned address.
ipconfig /all and ipconfig /displaydns - confirms which DNS server the client uses and whether a
cached entry persists.
DNS Manager on DMZ_Server_3 - inspects forward lookup zones, host records, and forwarder
configuration.
ipconfig /flushdns followed by a browser or ping test - removes stale client cache and validates
the corrected lookup.
A2b. Tool Justification
DNS-specific tools were required because the symptom was name-dependent: the client could reach a
site, but the requested name produced the wrong destination. nslookup separates name resolution
from browser behavior, while DNS Manager exposes the authoritative internal record that can override
public DNS. Cache inspection and flushing distinguish a corrected server record from an old client-side
response.
A2c. Troubleshooting Process and Resolution
1. Reproduced the report from USER_Net and recorded the unexpected destination without entering
credentials or downloading content.
2. Ran ipconfig /all to confirm that the client was using DMZ_Server_3 for DNS.
Student Working Report | Page 3
, WGU D412 | Network Analytics and Troubleshooting
3. Queried www.wgu.edu with nslookup and recorded both the responding DNS server and returned IP
address.
4. Compared the result with an external or known-good resolution only as permitted by the lab,
establishing that the internal reply was inconsistent.
5. Opened DNS Manager on DMZ_Server_3 and inspected the relevant forward lookup zone, host
record, and forwarder entries.
6. Located the incorrect [A/zone/forwarder] entry and documented it before alteration.
7. Removed or corrected only the erroneous entry, then cleared the DNS server cache if required.
8. Flushed the USER_Net client resolver cache and repeated nslookup before reopening the site.
Corrective action: Correct the invalid DNS object on DMZ_Server_3 so www.wgu.edu is resolved
through an approved authoritative path. Record the exact record name, old value, new value, and
change time: [insert verified values].
Verification: A new nslookup query must show the approved DNS server and a legitimate destination,
and the browser must reach www.wgu.edu without redirection. The screenshot should show both the
successful result and system date/time.
B. Business Recommendation
Implement DNS change control, role-based administrative access, secure dynamic updates, DNS logging,
and automated monitoring for newly created or modified zones and high-risk records. Schedule periodic
comparison of internal responses with approved external resolvers and alert security staff when a
protected domain resolves unexpectedly.
Client Diagnostic Questions
When did the redirection first occur, and does it affect every USER_Net device?
Does the problem occur by hostname only, or also when using a known IP address?
Which DNS server is displayed on the affected client?
Did the user receive a certificate warning or enter credentials on the redirected page?
Student Working Report | Page 4
