Tech questions and answers

A switch connects devices within the same network using MAC addresses, while a router connects different networks together using IP addresses. Inside an office, the switch moves traffic between PCs, printers and access points on one LAN. The router sits at the edge and forwards traffic between that LAN and other networks, such as the internet or another branch. A typical home "router" is actually a router, switch, access point and modem combined in one box.

Read the full note: Modem, router, switch, access point: what each one does

The seven OSI layers, from bottom to top, are Physical, Data Link, Network, Transport, Session, Presentation and Application. A common memory aid is "Please Do Not Throw Sausage Pizza Away". Each layer has a job: the Physical layer carries bits, Data Link handles frames and MAC addresses, Network handles IP addressing and routing, and Transport handles TCP and UDP. Engineers use the model mainly for troubleshooting, working up from the cable to the application.

Read the full note: The OSI model, used the way engineers really use it

The OSI model has seven layers and is a teaching and troubleshooting reference, while the TCP/IP model has four layers and describes how the internet actually works. TCP/IP merges OSI's Application, Presentation and Session layers into one Application layer, and merges Physical and Data Link into a Network Access (or Link) layer. Its Internet and Transport layers line up with OSI layers 3 and 4. In practice, engineers still say "a Layer 2 problem" using OSI numbers.

Read the full note: The OSI and TCP/IP models: layers, functions and encapsulation

TCP is connection-oriented and reliable: it sets up a session with a three-way handshake, numbers every segment and resends anything lost. UDP is connectionless and simply sends datagrams with no delivery guarantee, which makes it lighter and faster. Use TCP when every byte must arrive, such as web pages, email and file transfers. UDP suits real-time traffic such as voice calls, video streaming, online games and DNS lookups, where a late packet is useless anyway.

Read the full note: TCP, UDP and port numbers in simple terms

HTTPS uses TCP port 443 by default, while plain HTTP uses TCP port 80. Modern browsers using HTTP/3 also run HTTPS over UDP port 443 with the QUIC protocol. When you type a web address starting with https:// and no port number, your browser automatically connects to port 443. Firewalls almost always allow outbound 443, which is why it is the most important port to understand when troubleshooting web access.

Read the full note: Application layer protocols and their ports: FTP, SSH, Telnet, SMTP, POP3, DNS, HTTP(S), DHCP, SNMP

The common well-known ports are FTP 20/21, SSH 22, Telnet 23, SMTP 25, DNS 53, DHCP 67/68, HTTP 80, POP3 110, NTP 123, IMAP 143, SNMP 161, HTTPS 443 and RDP 3389. These come up constantly in CCNA, Security+ and real firewall rules. Note which are TCP and which are UDP: DNS uses UDP 53 for most queries and TCP 53 for large responses and zone transfers, while DHCP, NTP and SNMP use UDP.

Read the full note: Application layer protocols and their ports: FTP, SSH, Telnet, SMTP, POP3, DNS, HTTP(S), DHCP, SNMP

DNS translates domain names such as example.com into IP addresses so your device knows where to connect. Your computer asks a recursive resolver, usually run by your ISP or a public service. If the answer is not cached, the resolver asks a root server, then the top-level domain server (such as .com), then the domain's authoritative server, which returns the address. The answer is cached for a set time (the TTL), so repeat lookups are almost instant.

Read the full note: How DNS works: the internet's phonebook

DHCP automatically gives devices an IP address, subnet mask, default gateway and DNS server when they join a network. It uses a four-step exchange called DORA: the client sends a Discover broadcast, the server replies with an Offer, the client sends a Request, and the server confirms with an Acknowledge. The address is leased for a set time and renewed automatically. Without DHCP, you would have to type IP settings into every phone and laptop by hand.

Read the full note: DHCP: how devices get an IP address automatically

NAT (Network Address Translation) lets many devices with private IP addresses share one public IP address on the internet. Your home router rewrites the source address of outgoing packets to its public address and keeps a table so replies go back to the right device. The most common form, PAT or NAT overload, also tracks port numbers. NAT was introduced to slow down IPv4 address exhaustion, and it also hides internal addresses, though it is not a firewall on its own.

Read the full note: NAT: how many devices share one internet address

The three private IPv4 ranges defined in RFC 1918 are 10.0.0.0/8, 172.16.0.0/12 (172.16.0.0 to 172.31.255.255) and 192.168.0.0/16. These addresses are free for anyone to use inside homes and organisations but are not routed on the public internet, so NAT is needed to get online. Home routers usually use 192.168.0.x or 192.168.1.x. Do not confuse them with 169.254.x.x, which is an automatic address a device gives itself when DHCP fails.

Read the full note: IPv4 addressing: classes, subnet masks, private ranges and subnetting

A /24 subnet has 254 usable host addresses. It contains 256 addresses in total (2 to the power of 8 host bits), but the first is the network address and the last is the broadcast address, so neither can be given to a device. The general formula is 2 to the power of the host bits, minus 2. For comparison, a /25 gives 126 hosts, a /26 gives 62, a /27 gives 30 and a /30 gives 2.

Read the full note: Subnetting in your head: the block-size method

Use the block-size method: subtract the interesting octet of the mask from 256 to get the block size, then count up in that block. For 255.255.255.192 (/26), 256 − 192 = 64, so the subnets start at .0, .64, .128 and .192. For the host 192.168.1.100/26, the network is .64, the broadcast is .127 and usable hosts run from .65 to .126. With practice this takes seconds and needs no binary conversion.

Read the full note: Subnetting in your head: the block-size method

A MAC address is a 48-bit hardware address burned into a network card and used for delivery on the local network, while an IP address is a logical address used to route traffic between networks. Think of the IP address as a postal address that gets a parcel to the right town and street, and the MAC address as the name on the front door. Devices use ARP to find the MAC address that matches a local IPv4 address.

Read the full note: Ethernet frames and MAC addresses: structure, types and how to read them

IPv4 uses 32-bit addresses written as four decimal numbers, such as 192.168.1.10, giving about 4.3 billion addresses. IPv6 uses 128-bit addresses written in hexadecimal, such as 2001:db8::1, giving a practically unlimited supply. IPv6 removes the need for NAT, has no broadcasts, and lets devices configure their own addresses with SLAAC. Most networks today run both side by side, known as dual stack.

Read the full note: IPv6 explained: why we need it, address structure, shortening rules and address types

A VLAN (virtual LAN) splits one physical switch into several separate logical networks. Devices in different VLANs cannot talk to each other directly; traffic between them must pass through a router or Layer 3 switch. Organisations use VLANs to separate staff, guests, voice phones, printers and CCTV, which reduces broadcast traffic and improves security. For example, putting guest Wi-Fi in its own VLAN stops visitors reaching internal file servers.

Read the full note: VLANs and trunks: concepts, configuration and common mistakes

An access port carries traffic for a single VLAN and normally connects to an end device such as a PC or printer. A trunk port carries traffic for many VLANs over one link, usually between switches or to a router, and uses 802.1Q tags to mark which VLAN each frame belongs to. Untagged frames on a trunk belong to the native VLAN. A common mistake is a native VLAN mismatch between the two ends of a trunk.

Read the full note: VLANs and trunks: concepts, configuration and common mistakes

OSPF is an open-standard link-state protocol that works on any vendor's equipment and uses cost, based on bandwidth, as its metric. EIGRP is an advanced distance-vector protocol created by Cisco that uses bandwidth and delay by default and the DUAL algorithm for very fast failover. OSPF needs careful area design in large networks, while EIGRP is simpler to configure. In mixed-vendor networks OSPF is the usual choice, and it is the main routing protocol tested on the current CCNA.

Read the full note: Routing operations: static routing and dynamic routing protocols compared

Static routes are typed in manually by an administrator and never change unless someone edits them. Dynamic routing uses protocols such as OSPF, EIGRP or BGP so routers learn routes from each other and adapt automatically when a link fails. Static routing suits small networks and default routes to an ISP because it is simple and predictable. Dynamic routing suits larger networks where maintaining hundreds of manual routes would be slow and error-prone.

Read the full note: Routing operations: static routing and dynamic routing protocols compared

Administrative distance (AD) is how much a router trusts a route source; lower is preferred. When two protocols offer a route to the same network, the router installs the one with the lower AD. Cisco defaults are: connected 0, static 1, EIGRP 90, OSPF 110, RIP 120, and external EIGRP 170. A floating static route uses a deliberately high AD so it is only used as a backup when the dynamic route disappears.

Read the full note: How routers forward packets: the routing table, longest prefix match, AD and metrics

A default gateway is the router address a device sends traffic to when the destination is outside its own subnet. If your laptop is 192.168.1.20/24 and you open a website, it notices the server is on another network and forwards the packet to the gateway, often 192.168.1.1. If the gateway is missing or wrong, you can reach local devices but not the internet. On a router, the equivalent is a default route, 0.0.0.0/0.

Read the full note: Static, default and floating static routes: configuration, tracking and pitfalls

Spanning Tree Protocol (STP) prevents Layer 2 loops when switches are connected with redundant links. Without it, broadcast frames would circle forever and cause a broadcast storm that can take down the whole network in seconds. STP elects a root bridge, works out the best path to it, and blocks the extra links. If an active link fails, a blocked one takes over. Modern networks use Rapid PVST+ or RSTP for much faster convergence.

Read the full note: Layer 2 redundancy: spanning tree and EtherChannel

Inter-VLAN routing lets devices in different VLANs communicate by passing their traffic through a Layer 3 device. The two common methods are router-on-a-stick, where one router interface is split into subinterfaces, one per VLAN, over a trunk, and SVIs on a Layer 3 switch, where each VLAN gets a virtual interface that acts as its gateway. SVIs are faster and standard in modern campus networks, while router-on-a-stick suits small labs and branches.

Read the full note: Inter-VLAN routing in practice: router-on-a-stick, SVIs and troubleshooting

An access control list (ACL) is an ordered list of permit and deny rules that a router or switch uses to filter traffic. Standard ACLs match only the source IP address, while extended ACLs match source, destination, protocol and port. Rules are checked top to bottom and the first match wins, and every ACL ends with an invisible "deny any". The usual guidance is to place extended ACLs close to the source and standard ACLs close to the destination.

Read the full note: Access control lists: purpose, types, placement and best practice

EtherChannel bundles several physical switch links into one logical link for more bandwidth and redundancy. Instead of Spanning Tree blocking all but one of four parallel cables, EtherChannel lets all four carry traffic, and if one fails the others keep working. It can be negotiated with the open standard LACP, Cisco's PAgP, or set statically. All member ports must match in speed, duplex and VLAN settings, or the bundle will not form.

Read the full note: Layer 2 redundancy: spanning tree and EtherChannel

2.4 GHz Wi-Fi reaches further and passes through walls better, while 5 GHz is much faster but has shorter range. The 2.4 GHz band has only three non-overlapping channels and is crowded by neighbours, Bluetooth and microwaves. The 5 GHz band has many more channels and less interference. A simple rule: use 5 GHz for laptops, TVs and phones near the router, and leave 2.4 GHz for distant rooms and smart-home gadgets that only support it.

Read the full note: Wi-Fi basics and how to secure your wireless network

WPA3 is the newer, stronger Wi-Fi security standard. It replaces WPA2's pre-shared key handshake with SAE, which resists offline password-guessing attacks even when the password is fairly weak, and it requires Protected Management Frames. WPA3 also adds Enhanced Open for encrypted public hotspots. Use WPA3 where all your devices support it, or WPA2/WPA3 transition mode if older devices still need WPA2. Avoid WEP and original WPA completely.

Read the full note: Wireless security testing: what assessors check and how to harden Wi-Fi

Wi-Fi 6 (802.11ax) and Wi-Fi 7 (802.11be) are the latest Wi-Fi generations, built to handle many devices at once rather than just raw speed. Wi-Fi 6 introduced OFDMA and target wake time to improve busy networks and battery life, and Wi-Fi 6E added the 6 GHz band. Wi-Fi 7 adds 320 MHz channels and Multi-Link Operation, which lets a device use several bands at the same time for lower latency. Both need compatible devices to see the benefit.

Read the full note: Wi-Fi 7 (802.11be) and the future of wireless LANs

It usually means your device has reached the router but the router cannot reach the internet, or your device has no valid IP or DNS settings. First, restart the router and modem and check whether other devices are affected. If only one device fails, forget the network and reconnect, or check for a 169.254.x.x address, which means DHCP failed. If every device fails, the problem is likely your ISP line, so check its status page or call them.

Read the full note: Configuring and verifying network connections: Windows settings, ping, traceroute, Telnet and SSH

A mesh Wi-Fi system uses several access points that work together as one network, so you get a single network name and seamless coverage across a large home. One unit connects to your modem and the others, called satellites or nodes, link back to it wirelessly or over Ethernet cable. Mesh is better than a basic range extender, which often halves speed and creates a second network. For best results, connect the nodes with cable where you can.

Read the full note: Wi-Fi basics and how to secure your wireless network

Use WPA3 or WPA2 encryption with a long, unique password, and change the router's default admin password. Then keep the router firmware updated, turn off WPS and remote management, and put visitors and smart-home gadgets on a separate guest network so they cannot reach your laptops. Hiding the network name adds little real protection. Finally, check the list of connected devices now and then and remove anything you do not recognise.

Read the full note: Wi-Fi basics and how to secure your wireless network

An access point simply adds wireless connectivity to an existing wired network, while a router connects different networks and handles jobs such as NAT, DHCP and the firewall. Most home "Wi-Fi routers" contain both. In offices and schools, the routers and firewalls sit in the server room, and many separate access points are mounted on ceilings, often managed together by a wireless LAN controller or cloud dashboard.

Read the full note: Network devices: NIC, hub, switch, bridge, router, access point, modem, firewall and more

Public Wi-Fi is reasonably safe for everyday browsing today because most websites use HTTPS, but it still carries risks. An attacker could run a fake hotspot with a similar name, or the network itself could be poorly secured. Check the exact network name with staff, avoid logging into banking or work systems on unknown networks, keep your device updated, and turn off automatic joining. Using a trusted VPN or your phone's mobile data adds a sensible extra layer.

Read: How a VPN works, and when you actually need one

A firewall is a security device or program that allows or blocks network traffic based on rules. It inspects each connection, checking things like source, destination, port and protocol, and decides whether to let it through. A stateful firewall also remembers outgoing connections so replies are allowed back in automatically. Next-generation firewalls go further, identifying applications and users and blocking known threats. Every home router and operating system includes a basic firewall.

Read the full note: Firewalls explained: stateless, stateful and next-generation

Phishing is a scam message that pretends to come from a trusted organisation to trick you into clicking a link, opening an attachment or giving away details. Warning signs include urgency ("your account will be closed today"), a sender address that does not quite match, links that point to strange domains, unexpected attachments and requests for passwords or payment. If in doubt, do not click; open the company's app or website yourself and check from there.

Read the full note: Phishing: how to spot fake emails and messages

MFA means proving who you are with two or more different types of evidence: something you know (a password), something you have (a phone, security key or authenticator app) and something you are (a fingerprint or face). Even if a criminal steals your password, they cannot sign in without the second factor. Authenticator apps, passkeys and hardware security keys are stronger than SMS codes, which can be intercepted through SIM-swap fraud.

Read the full note: Strong passwords and multi-factor authentication

Ransomware is malicious software that encrypts your files or systems and demands payment for the key, and modern gangs often steal data first and threaten to leak it. The best protection is regular backups kept offline or immutable and tested for restoring, prompt patching, MFA on remote access and email, limited admin rights, and staff training against phishing. If hit, disconnect affected machines, report it, and seek expert help before considering any payment.

Read the full note: Responding to ransomware: the first hours, recovery and prevention

A VPN (virtual private network) creates an encrypted tunnel between your device and a VPN server, so anyone on the local network or your ISP sees only scrambled traffic going to that server. Websites see the VPN server's IP address instead of yours. Businesses use VPNs so staff can reach internal systems securely from home, and to link branch offices. A VPN hides traffic in transit, but it does not stop malware, phishing or tracking by sites you log into.

Read the full note: VPNs and site-to-site IPsec: types, framework and configuration

Malware is the umbrella term for any malicious software, and a virus is just one type of it. A virus attaches itself to a legitimate file and spreads when that file is run. Other kinds of malware include worms, which spread on their own across networks, trojans, which pose as useful programs, ransomware, spyware, keyloggers and botnet agents. Modern security tools such as EDR detect behaviour rather than only known virus signatures.

Read the full note: Why network security matters: attackers, malware and security policy

An IDS (intrusion detection system) watches traffic and raises alerts when it spots something suspicious, but does not block it. An IPS (intrusion prevention system) sits inline in the traffic path and can drop malicious packets automatically. An IDS is safer to deploy because it cannot accidentally block legitimate traffic, while an IPS stops attacks in real time. Many next-generation firewalls include IPS features built in.

Read the full note: Firewalls, next-generation firewalls, IDS and IPS

Encryption is two-way and hashing is one-way. Encrypted data can be turned back into the original with the right key, so it is used to protect files, messages and network traffic. A hash turns any input into a fixed-length fingerprint that cannot be reversed, so it is used to check file integrity and to store passwords safely. For example, SHA-256 is a hash, while AES is an encryption algorithm. MD5 and SHA-1 are now considered weak.

Read the full note: Encryption and hashing: ciphers, symmetric and asymmetric keys, MD5, SHA and HMAC

A DDoS (distributed denial-of-service) attack floods a website or network with traffic from many machines at once so genuine users cannot get through. The attacking machines are usually a botnet of hacked computers, routers and IoT devices. Attacks can target bandwidth, server resources or the application itself. Defences include DDoS protection services from cloud providers or ISPs, content delivery networks, rate limiting and a prepared response plan.

Read the full note: Denial of service, DDoS and social engineering attacks

Zero trust is a security approach that says "never trust, always verify": no user or device is trusted just because it is on the company network. Every request is checked using identity, device health and context, and people get only the minimum access they need. In practice this means strong MFA, segmented networks, least-privilege permissions and continuous monitoring. It replaces the old model of a hard perimeter firewall with a trusted inside.

Read the full note: Zero Trust in plain words

Social engineering is manipulating people, rather than hacking systems, to get access or information. Examples include phishing emails, phone calls from fake IT support (vishing), text scams (smishing), pretexting with a made-up story, and tailgating through secure doors. Attackers exploit trust, urgency, fear and helpfulness. The best defences are awareness training, clear procedures for verifying requests, and a culture where staff feel safe to report and to say no.

Read the full note: Social engineering assessments and building awareness

A passkey is a sign-in method that replaces your password with a cryptographic key pair stored on your device, unlocked with your fingerprint, face or PIN. Yes, it is generally safer: there is no password to guess, reuse or leak, and passkeys are tied to the real website, so they resist phishing. Google, Apple, Microsoft and many major services now support them, and they can sync across your devices through your password manager or platform account.

Read the full note: MFA and passwordless sign-in: factors, FIDO2 and passkeys

The CIA triad stands for Confidentiality, Integrity and Availability, the three core goals of information security. Confidentiality means only authorised people can see data, for example through encryption and access control. Integrity means data is not altered without permission, checked with hashing and digital signatures. Availability means systems and data are there when needed, supported by backups, redundancy and DDoS protection. Most security controls protect one or more of these three.

Read the full note: What is cyber security? Assets, threats, impact and careers

Change the password straight away from a clean device, turn on MFA, and sign out all other sessions. Then check the account's recovery email, phone number and forwarding rules, as attackers often change these to keep access. Change the same password anywhere else you used it, warn your contacts if scam messages were sent, and contact the service provider or your bank if money is involved. Finally, scan your device for malware.

Read: Hacked account: what to do now

AWS (Amazon Web Services) and Microsoft Azure are the two largest public cloud platforms and offer very similar core services: virtual machines, storage, networking, databases and AI. AWS has the longest track record and the widest range of services. Azure fits naturally with Microsoft 365, Entra ID and Windows Server, so it is popular with organisations already using Microsoft. For a career, the concepts transfer well, so learn one thoroughly and the other becomes much easier.

Read the full note: Multi-cloud: reasons, challenges, portability and consistent security

They describe how much the cloud provider manages for you. With IaaS you rent virtual machines, storage and networks and manage the operating system yourself, as with AWS EC2. With PaaS the provider runs the platform and you just deploy your code, as with Azure App Service. With SaaS you simply use finished software over the internet, such as Microsoft 365 or Gmail. Moving from IaaS to SaaS, you control less but manage less too.

Read the full note: What is cloud computing? IaaS, PaaS and SaaS explained

The shared responsibility model splits security duties between the cloud provider and the customer. The provider secures the "security of the cloud": data centres, hardware and the core infrastructure. The customer is responsible for "security in the cloud": their data, user accounts, access permissions, network rules and configuration. Most cloud breaches come from customer-side mistakes, such as a public storage bucket or an admin account without MFA, not from the provider being hacked.

Read the full note: The cloud shared responsibility model

A public cloud is run by a provider such as AWS, Azure or Google Cloud and shared by many customers. A private cloud is dedicated to one organisation, either in its own data centre or hosted for it. A hybrid cloud connects the two, so a company can keep sensitive systems on-premises while using public cloud for flexible workloads. Many organisations also use several public clouds together, which is called multi-cloud.

Read the full note: Cloud deployment models: public, private, hybrid, community and multi-cloud

A VPC (Virtual Private Cloud) is your own isolated private network inside AWS, where you choose the IP address range and create subnets, route tables and gateways. Public subnets have a route to an internet gateway, while private subnets do not and reach out through a NAT gateway if needed. Security groups and network ACLs control traffic in and out. Azure's equivalent is a Virtual Network (VNet), and Google Cloud also calls it a VPC.

Read the full note: Cloud networking basics: VPCs, VNets, subnets, route tables and gateways

Serverless computing lets you run code without managing any servers: the cloud provider starts, scales and stops the computing resources automatically, and you pay only while your code runs. Examples include AWS Lambda, Azure Functions and Google Cloud Run functions. It suits event-driven tasks such as resizing an uploaded image or handling an API request. There are still servers underneath; you just never see or patch them.

Read the full note: Compute options: virtual machines, containers and serverless compared

Start with an entry-level fundamentals exam: AWS Certified Cloud Practitioner or Microsoft Azure Fundamentals (AZ-900). Both teach core cloud ideas, pricing and the shared responsibility model without needing deep technical experience. Choose the platform most used by employers in your area. Then move to an associate-level exam such as AWS Solutions Architect Associate or Azure Administrator (AZ-104), and add a security exam later if you are aiming for cloud security work.

Read the full note: Breaking into networking and security: a practical roadmap

A virtual machine includes a full guest operating system on top of a hypervisor, while a container shares the host's operating system kernel and packages only the app and its libraries. That makes containers much smaller and faster to start, ideal for microservices and modern apps run with Docker and Kubernetes. Virtual machines give stronger isolation and can run a different operating system, such as Windows on a Linux host. Many cloud setups run containers inside VMs.

Read the full note: Containers versus virtual machines: images, layers and isolation

The Internet of Things (IoT) is the network of everyday physical objects that carry sensors, a small computer and a connection, so they can collect data and be controlled remotely. Examples include smart thermostats, fitness trackers, connected doorbells and factory machines that report their own condition.

A typical IoT system has four parts: the device, a connection (Wi-Fi, Bluetooth, cellular or LPWAN), a platform that stores and processes the data, and an app or dashboard where people see results and take action.

Read the full note: What is the Internet of Things (IoT)?

MQTT is a lightweight publish/subscribe messaging protocol designed for small devices on unreliable or low-bandwidth networks. Devices publish messages to topics on a central broker, and any client subscribed to that topic receives them.

It is popular because headers are tiny, connections stay open, and it offers three quality-of-service levels. For example, a temperature sensor can publish to home/kitchen/temp and a dashboard simply subscribes. Always run it over TLS (port 8883) with authentication rather than plain port 1883.

Read the full note: MQTT explained: brokers, topics, QoS and retained messages

Zigbee and Thread are low-power mesh radio networks, while Matter is an application standard that runs on top of Thread, Wi-Fi or Ethernet. Zigbee is mature and widely used in smart bulbs and sensors but needs a hub. Thread is IP-based, so devices can talk to each other and the internet through a border router.

Matter, backed by Apple, Google, Amazon and Samsung, aims to let a device from any brand work with any compatible ecosystem, reducing the need to check compatibility before buying.

Read the full note: Zigbee, Thread and Matter: mesh networking for smart homes

Use an Arduino (or ESP32) for simple, low-power sensing and control; use a Raspberry Pi when you need a full operating system. Microcontrollers start instantly, run one program, sip power and handle precise timing well, which suits a soil-moisture sensor on batteries.

A Raspberry Pi is a single-board computer running Linux, so it can host a web dashboard, a database, a camera stream or an MQTT broker. Many projects combine both: ESP32 sensors sending data to a Pi acting as the hub.

Read the full note: Microcontrollers vs single-board computers: Arduino, ESP32 and Raspberry Pi

Change default passwords, keep firmware updated and put smart devices on a separate network. Many routers offer a guest or IoT network, so a compromised camera or plug cannot reach your laptop or phone.

• Buy from brands that publish a security update period.
• Turn off features you do not use, such as remote access or UPnP.
• Use two-step verification on the companion app account.
• Remove devices you no longer use from the app and the network.

Read the full note: Segmenting IoT on enterprise and home networks

LoRaWAN is a low-power wide-area network (LPWAN) used to send small amounts of data over long distances from battery-powered devices. A single gateway can cover several kilometres in rural areas, and sensors can run for years on one battery.

It suits smart agriculture, water meters, parking sensors, asset tracking and environmental monitoring, where a device sends a few bytes every few minutes. It is not suitable for video or voice, because data rates are very low.

Read the full note: LPWAN compared: LoRaWAN, Sigfox, NB-IoT and LTE-M

IT security protects data and business systems, while OT (operational technology) security protects physical processes such as factories, power grids and water plants. In IT, confidentiality usually comes first; in OT, safety and availability matter most, because stopping a process can damage equipment or endanger people.

OT systems often run old software that cannot easily be patched or rebooted, so defences rely on network segmentation, strict remote access control and passive monitoring rather than aggressive scanning.

Read the full note: Operational technology versus IT: priorities, lifetimes and safety

A digital twin is a live virtual model of a physical object, system or process, kept up to date with real sensor data. Engineers use it to monitor condition, test changes and predict failures without touching the real thing.

For example, a wind farm operator can run a twin of each turbine, compare vibration and temperature with the model, and schedule maintenance before a fault occurs. Twins are also used for buildings, supply chains, networks and city planning.

Read the full note: Digital twins for IoT: what they are and how they are used

Yes. Python is the most widely used language for network automation, thanks to its readable syntax and mature libraries such as Netmiko, NAPALM, Nornir and the built-in ipaddress module.

A network engineer can use it to back up configurations from hundreds of switches, check for interface errors, generate VLAN configs from a spreadsheet or call vendor APIs. You do not need to be a software developer: knowing variables, loops, functions and how to read JSON covers most everyday automation tasks.

Read the full note: Python for network engineers: libraries and a first automation script

An API (application programming interface) is a defined way for one piece of software to ask another for data or actions. It sets out which requests are allowed, what format to use and what comes back.

A weather app, for instance, does not measure the weather itself; it sends a request to a weather service API and receives the forecast as JSON. In networking, controllers and cloud platforms expose REST APIs so engineers can automate configuration instead of clicking through a web interface.

Read the full note: What an API is and how REST APIs work

Both are text formats for structured data, but JSON is lighter and easier to read, while XML is more verbose and supports schemas and attributes. JSON uses key/value pairs and arrays, for example {"hostname": "sw1", "vlans": [10, 20]}.

Most modern web and REST APIs use JSON. XML is still common in older enterprise systems, SOAP services and NETCONF, which network devices use with YANG data models. Python handles both through the json module and libraries such as xml.etree.

Read the full note: JSON and XML for APIs: structure, parsing and pitfalls

Ansible is an open-source automation tool used to configure servers and network devices, deploy software and run repeatable tasks across many systems. You describe the desired state in YAML files called playbooks, and Ansible connects over SSH or APIs to apply it.

It is agentless, so nothing needs installing on the target devices, which makes it popular with network teams. A single playbook can push the same NTP and logging settings to every router, or update hundreds of Linux servers in one run.

Read the full note: Ansible architecture and concepts: control node, inventory, modules and idempotency

Git is a version control system that records every change to your files, so you can see history, undo mistakes and work with others safely. Platforms such as GitHub and GitLab host Git repositories online.

It is worth learning even if you are not a developer: network and cloud engineers keep scripts, Ansible playbooks, Terraform code and device configs in Git. The core commands to start with are git clone, git add, git commit, git push and git pull.

Read the full note: Git basics for engineers: commits, branches and remotes

Learn the shell for the systems you use most: Bash for Linux and network or cloud work, PowerShell for Windows and Microsoft 365 administration. Most servers, containers and network appliances run Linux, so Bash is very useful early on.

If your job involves Active Directory, Exchange Online or Intune, PowerShell will save time sooner. Both share the same ideas of variables, loops and piping output between commands, so the second one is far easier once you know the first.

Read the full note: Bash scripting basics: variables, conditions, loops and exit codes

A GET request asks a server for data, while a POST request sends data to the server to create something or trigger an action. GET parameters appear in the URL and are meant to be safe to repeat; POST data travels in the request body.

Loading a product page is a GET; submitting a checkout form is a POST. REST APIs also use PUT or PATCH to update records and DELETE to remove them, along with status codes such as 200, 201, 404 and 500.

Read the full note: HTTP methods, URLs, headers and status codes for APIs

Infrastructure as code (IaC) means defining servers, networks and cloud resources in text files instead of setting them up by hand. Tools such as Terraform, OpenTofu, Ansible and AWS CloudFormation read those files and build the environment to match.

Because the files live in Git, changes can be reviewed, tested and rolled back, and the same environment can be rebuilt identically. For example, a Terraform file can create a VPC, subnets and security groups in a few minutes, every time, without clicking.

Read the full note: Lab: infrastructure as code with Terraform basics

Pick one beginner-friendly language, usually Python, and build tiny practical projects from the first week. Learn variables, conditions, loops, lists and functions, then apply them to something you actually care about.

Good first projects include a script that renames files, a ping checker for a list of IP addresses or a simple calculator. Practise little and often, read error messages carefully, and keep your code on GitHub so you can see your progress over time.

Read the full note: Python basics for network engineers: install, run, variables, loops and if

A regular expression (regex) is a pattern used to search, match or extract text. It is useful whenever you need to find structured information inside messy output or logs.

For example, the pattern \d{1,3}(\.\d{1,3}){3} matches IPv4-style addresses, so a script can pull every IP out of a firewall log. Network engineers often use regex in Python, grep and router filters such as show run | include to parse command output.

Read the full note: Parsing device output and logs with Python regular expressions

A server is a computer built or configured to provide services to other computers, usually running all day without anyone sitting at it. Server hardware adds features such as redundant power supplies, error-correcting (ECC) memory, hot-swap drives and remote management.

Any PC can act as a small server, for example sharing files at home. In businesses, servers host websites, email, databases and directory services, often in racks, as virtual machines or in the cloud.

Read the full note: Server hardware: CPU, ECC memory, storage, NICs and redundant power

A NAS shares storage as files over a normal network, while a SAN provides block-level storage over a dedicated high-speed network. To a computer, NAS storage looks like a shared folder (SMB or NFS); SAN storage looks like a local disk.

A small office might use a NAS for shared documents and backups. Data centres use SANs, via Fibre Channel or iSCSI, for databases and virtual machine storage that need high performance and low latency.

Read the full note: Server storage: DAS, NAS and SAN compared

A virtual machine (VM) is a software-based computer that runs its own operating system on shared physical hardware. A hypervisor such as VMware ESXi, Hyper-V, Proxmox or KVM divides the real CPU, memory and storage between several VMs.

This lets one physical server run many isolated systems, for example a web server, a database and a domain controller. VMs are also ideal for learning, because you can take a snapshot, break something in a lab and roll back in seconds.

Read the full note: Virtualisation and virtual machines for beginners

A virtual machine includes a full guest operating system, while a container shares the host's kernel and packages only the application and its dependencies. That makes containers much smaller and faster to start.

VMs give stronger isolation and can run different operating systems on one host. Containers, built with tools such as Docker and managed by Kubernetes, suit modern applications that are split into many small services and deployed frequently. Many organisations run containers inside VMs to get both.

Read the full note: Containers versus virtual machines: images, layers and isolation

Active Directory (AD) is Microsoft's directory service for managing users, computers and permissions centrally in a Windows network. Domain controllers store accounts and handle sign-in, so a member of staff uses one username across all company PCs.

Administrators use Group Policy to apply settings such as password rules, drive mappings and security baselines to many machines at once. For cloud services, Microsoft Entra ID plays a similar role, and many organisations sync the two in a hybrid set-up.

Read the full note: Windows Server core roles: AD DS, DNS, DHCP and Group Policy

RAID 1 mirrors data onto two drives, while RAID 5 spreads data and parity across three or more drives. Both survive the failure of one disk. RAID 1 is simple and fast to rebuild but uses half your raw capacity; RAID 5 gives more usable space but rebuilds slowly on large drives.

Remember that RAID is not a backup: deletion, ransomware or a controller fault affects every disk at once, so you still need separate, ideally offline, backups.

Read the full note: Server hardware: CPU, ECC memory, storage, NICs and redundant power

Keep it patched, reduce what is running and lock down remote access. These steps cover most of the risk on a new server:

• Use SSH keys, disable password and root login.
• Enable a host firewall such as ufw or nftables and allow only needed ports.
• Remove unused packages and services.
• Turn on automatic security updates.
• Use sudo with named accounts and send logs to a central system.

Benchmarks such as CIS give a fuller checklist.

Read the full note: Lab: hardening a Linux server (SSH, firewall, updates)

99.9% uptime ("three nines") allows roughly 8 hours 46 minutes of downtime per year, or about 43 minutes per month. Each extra nine cuts that sharply: 99.99% allows about 52 minutes a year, and 99.999% about 5 minutes.

Service level agreements (SLAs) use these figures to set expectations and compensation. Reaching higher availability needs redundancy at every layer, such as clustered servers, load balancers, multiple power feeds and failover between data centres or cloud zones.

Read the full note: Availability, the nines and SLAs/SLOs

AI is the broad goal of making computers perform tasks that seem intelligent; machine learning is one approach to AI; deep learning is a type of machine learning. Machine learning systems learn patterns from data rather than following hand-written rules.

Deep learning uses large neural networks with many layers and powers image recognition, speech-to-text and large language models. A spam filter trained on example emails is machine learning; a chatbot built on a large language model is deep learning.

Read the full note: AI and machine learning basics for security people

A large language model (LLM) is an AI system trained on huge amounts of text to predict and generate language. By repeatedly predicting the most likely next piece of text, it can answer questions, summarise documents, translate and write code.

LLMs do not look facts up by default, so they can produce confident but wrong answers, often called hallucinations. That is why many tools connect them to search or company documents, and why important outputs should always be checked.

Read: How do AI chatbots work?

Prompt injection is an attack where hidden or malicious instructions are fed to an AI model so it ignores its intended rules. It can be direct, typed by a user, or indirect, buried in a web page, email or document the AI is asked to read.

It matters most when AI assistants can take actions such as sending emails or reading files. Defences include limiting the tools and data an AI can access, requiring human approval for sensitive actions and treating all external content as untrusted.

Read the full note: Securing LLM apps: prompt injection and the OWASP Top 10 for LLMs

AI helps defenders spot unusual behaviour, triage alerts faster and summarise incidents, and it is built into many modern EDR, SIEM and email security tools. It can flag an account logging in at an odd time from a new country or group thousands of alerts into a few incidents.

Attackers use it too, for convincing phishing emails, voice cloning and faster reconnaissance. AI works best as an assistant to skilled analysts rather than a replacement, since models still make mistakes.

Read the full note: AI for threat detection and security operations

It can be, provided you follow your organisation's policy and never paste confidential, personal or customer data into tools that are not approved. Business versions of AI assistants usually offer stronger data protection than free personal accounts.

Treat the output as a draft: check facts, figures and code before using them, and be clear when AI has helped. Good uses include drafting emails, summarising public documents and explaining concepts; poor uses include uploading contracts or staff records to an unknown tool.

Read the full note: Using AI tools safely at work: data, accuracy and policies

Edge computing means processing data close to where it is created, rather than sending everything to a distant cloud data centre. The "edge" might be a gateway in a factory, a server in a shop or a computer inside a vehicle.

It reduces delay, saves bandwidth and keeps working if the internet link drops. A camera system that detects safety hazards on site in milliseconds, then sends only short summaries to the cloud, is a typical example.

Read the full note: What edge computing is

A large enough quantum computer could break today's public-key encryption such as RSA and elliptic-curve cryptography, although no such machine exists yet. Symmetric encryption such as AES-256 is far less affected.

Because attackers can store encrypted data now and decrypt it later, organisations are already moving to post-quantum algorithms. NIST published its first standards in 2024 (ML-KEM and ML-DSA), and major browsers and messaging apps have begun using hybrid post-quantum key exchange.

Read the full note: The quantum threat to cryptography: Shor's and Grover's algorithms

AI agents are AI systems that can take actions on your behalf, not just answer questions, such as searching the web, filling in forms, booking appointments or running steps in a workflow. They combine a language model with access to tools, apps and data.

They can save time on repetitive tasks, but mistakes have real consequences. Give agents only the access they need, review sensitive actions such as payments or sending messages, and be alert to prompt injection hidden in content they read.

Read: Phone assistants that do things for you: the 2026 shift

Network slicing lets a mobile operator split one physical 5G network into several virtual networks, each tuned for a different purpose. One slice might guarantee very low latency for industrial robots, another provide high capacity for video, and another serve millions of low-power sensors.

Each slice has its own performance targets and can be isolated from the others. It depends on a 5G standalone core and is mainly used by businesses, emergency services and private 5G deployments rather than ordinary phone users.

Read the full note: 5G network slicing: logical networks on shared infrastructure

A blockchain is a shared record of transactions that many computers keep identical copies of, with each new block linked to the previous one by a cryptographic hash. Changing an old entry would break every link after it, so tampering is easy to detect.

Participants agree on new blocks through a consensus method such as proof of work or proof of stake. Beyond cryptocurrencies, it is used for supply-chain tracking and digital certificates, though a normal database is often the simpler choice.

Read the full note: How blockchain works: blocks, hashes and chains

Yes, CCNA is still worth it in 2026 for anyone starting in networking or network security. It proves you understand IP addressing, switching, routing, wireless, security basics and automation, which underpin cloud and cyber security roles too. Employers and recruiters still recognise it widely for support, NOC and junior network engineer jobs. It is most valuable when combined with hands-on lab practice and, later, a cloud or security certification.

Read the full note: Breaking into networking and security: a practical roadmap

Most people need around three to six months of steady study to pass the CCNA, depending on their background and the hours they can give each week. Someone already working in IT support may be quicker, while a complete beginner may need longer. Split your time between theory, daily subnetting practice and hands-on labs in Cisco Packet Tracer. Practice exams in the final weeks help you find weak areas and get used to the time pressure.

Read the full note: Lab: getting started with Cisco Packet Tracer and a first topology

CompTIA Network+ is vendor-neutral and gentler, while CCNA is harder, more hands-on and more valued for network engineering jobs. Network+ suits people heading towards general IT support or who want an easier first step. CCNA goes deeper into subnetting, routing, switching and Cisco command-line configuration, so it is the stronger choice if you want to become a network engineer. Many people skip Network+ and go straight to CCNA with good lab practice.

Read the full note: Breaking into networking and security: a practical roadmap

Start by learning networking and operating system basics, then build hands-on skills in a home lab, because security makes little sense without them. A common path is an IT support or helpdesk job, a foundation certificate such as CompTIA Security+ or ISC2 CC, then practice with free platforms and a home SIEM lab. Document your projects on GitHub or a blog. Entry-level security operations centre (SOC) analyst roles are a realistic first security job.

Read the full note: Breaking into networking and security: a practical roadmap

A network engineer designs, builds, maintains and troubleshoots the networks that connect an organisation's users, servers and cloud services. Typical daily work includes configuring switches, routers, firewalls and wireless access points, fixing connectivity problems, monitoring performance, applying security policies and planning upgrades. Senior engineers also design new sites and automate tasks with Python and Ansible. The role often starts from IT support or a NOC position.

Read the full note: Breaking into networking and security: a practical roadmap

No, a degree is not essential, but it can help. Many employers hire on skills, certifications such as CCNA or Security+, and proof of hands-on work, especially for support and junior engineer roles. A degree can open doors at larger organisations, government bodies and graduate schemes, and some roles abroad list one as a requirement. Whatever your route, a home lab, documented projects and real troubleshooting experience make your CV stand out.

Read the full note: Breaking into networking and security: a practical roadmap

Salaries vary widely by country, city, experience and specialism, so check current local job adverts rather than relying on a single figure. Entry-level support and NOC roles pay the least, while senior engineers with cloud, security or automation skills earn considerably more.

To get a realistic picture, compare several recent listings for the same job title in your area, look at published salary surveys from recruiters, and note which certifications and skills appear in the better-paid adverts.

Read the full note: Breaking into networking and security: a practical roadmap

Include a few well-documented projects that show what you can actually do, not just a list of courses. For each one, explain the problem, your design, the tools used, what went wrong and what you learnt, with diagrams and screenshots.

• A home or virtual network lab with VLANs and a firewall.
• An automation script or Ansible playbook on GitHub.
• A cloud build such as a secure VPC.
• A short write-up of a security lab or incident simulation.

Read the full note: Project: building a GitHub portfolio that gets interviews

You do not strictly need one, but a home lab is one of the best ways to gain hands-on experience before your first job. It also gives you real stories to talk about in interviews.

It need not be expensive: Cisco Packet Tracer, GNS3, VirtualBox or Proxmox on an old PC, plus cloud free tiers, cover most learning. Start with a goal, such as building a small office network with DHCP, VLANs and a firewall, and document each step.

Read the full note: Project: build a home lab network

Revise the fundamentals, practise explaining them out loud, and prepare real examples of problems you have solved. Expect questions on the OSI model, subnetting, VLANs, routing, DHCP, DNS and how you would troubleshoot a user with no internet.

Read the job description and research the company's technology. Use the STAR method (situation, task, action, result) for behavioural questions, and have one or two lab or portfolio projects ready to talk through in detail. It is fine to say how you would find an answer.

Read the full note: Troubleshooting LAN and WAN networks: methods, tools and common faults

No. Many people move into IT in their thirties, forties or later, and employers often value the communication and problem-solving skills they bring. Previous experience in customer service, finance, healthcare or engineering can become a real advantage in a related tech role.

Choose a clear path, such as IT support, networking or cloud, earn an entry-level certification, build a small lab and portfolio, and look for roles that bridge your old field and the new one.

Read the full note: Breaking into networking and security: a practical roadmap

Employers usually value proven experience most, but certifications help you get shortlisted, especially early in your career or when changing specialism. They show you have studied a recognised body of knowledge and are often used as filters in job adverts.

The strongest combination is a relevant certification, such as CCNA, Security+ or a cloud associate exam, backed by hands-on evidence: lab work, projects or support experience you can describe in detail at interview.

Read the full note: Becoming an ethical hacker: skills, certifications and legal practice

Slow Wi-Fi is usually caused by a weak signal, interference, too many devices or a slow broadband connection itself. Walls, floors, microwaves and neighbouring networks all reduce performance.

• Restart the router and move it to a central, raised, open spot.
• Use the 5 GHz band when you are close to the router.
• Test speed with a cable to see if the problem is Wi-Fi or the line.
• Consider a mesh system for larger homes.

Read: How Wi-Fi works, and how to make yours better

A cookie is a small text file a website stores in your browser to remember information about you. It keeps you logged in, remembers your basket and saves preferences such as language.

First-party cookies come from the site you are visiting and are mostly helpful. Third-party cookies are often used for advertising and tracking you across sites. You can review or block them in your browser settings and choose "reject non-essential" on cookie banners.

Read: Browsers and cookies: what they are and what to accept

Be suspicious of any message that creates urgency, asks for money, codes or personal details, or contains an unexpected link. Scammers pretend to be banks, delivery firms, tax offices or even family members.

• Check the sender's real address or number.
• Do not click links; go to the official app or website yourself.
• Never share one-time passcodes.
• If a "relative" asks for money, call them on a number you already know.

Read: How to spot scam messages

Mostly they can see which websites you visit, but not what you type or read on them, because nearly all sites and apps now use HTTPS encryption. The network owner, and anyone running a fake hotspot, can still see domain names and could try to trick you with false login pages.

Confirm the exact network name with staff, never click past browser certificate warnings, keep your device updated, and use a trusted VPN or your phone's hotspot for banking and work.

Read: How a VPN works, and when you actually need one

A modem connects your home to your internet provider, while a router shares that connection between your devices and creates your Wi-Fi network. The modem translates the signal from the phone line, cable or fibre; the router gives each device a local IP address and directs traffic.

Most internet providers now supply a single box that does both jobs, often called a hub or gateway, which is why people often use the two words interchangeably.

Read: Router or modem? What the box in your hallway really does

Your IP address is the number that identifies your connection on the internet, so websites know where to send data back. At home it is usually assigned by your internet provider and shared by every device on your network.

An IP address reveals only your approximate area and provider, not your home address. Only your provider can link it to you, and normally only under a legal request. A VPN hides your real IP from the sites you visit.

Read: What's an IP address, and should you worry about yours?

Yes. Two-step verification is one of the most effective ways to stop someone taking over your accounts, even if they have stolen your password.

After your password, you confirm the sign-in with a code from an authenticator app, a prompt on your phone or a security key. Turn it on first for email, banking, social media and shopping accounts. Where offered, passkeys are even better, because they cannot be phished.

Read: Turn on 2-step verification

Common signs are sent messages you did not write, password-reset emails you did not request, sign-in alerts from unfamiliar places and contacts receiving spam from you. Check your account's recent activity or devices page to confirm.

• Change the password from a clean device and sign out all sessions.
• Turn on two-step verification.
• Look for new forwarding rules or changed recovery details.
• Change any other account that reused the password.

Read: Hacked account: what to do now

Use a passphrase of three or more random, unrelated words, such as tulip-ferry-orbit-candle, and a different one for every account. Length matters more than complicated symbols.

The easiest way to manage many unique passwords is a password manager, built into most browsers and phones or available as a separate app. You then need to remember only one strong master passphrase. Add two-step verification for important accounts.

Read: Strong passwords made easy

Most people do not need a VPN on their home broadband, because their traffic to banks, email and shops is already encrypted with HTTPS. A VPN hides the sites you visit from your provider and your real IP address from websites.

It is more useful on untrusted Wi-Fi, when travelling or for remote access to work systems. It does not make you anonymous or stop scams and malware, so choose a reputable paid provider rather than an unknown free app.

Read: How a VPN works, and when you actually need one

The cloud means using computers, storage and software that run in someone else's data centre and are reached over the internet. When you save photos to iCloud or Google Photos, or use Microsoft 365, you are using the cloud.

You do not need to own or maintain the hardware, your files can be reached from any device, and you usually pay by subscription or by how much you use. The trade-off is depending on your internet connection and the provider.

Read: What is "the cloud"? Someone else's computer, explained

Look for small inconsistencies and, more importantly, check the source before believing or sharing it. Deepfakes are improving quickly, so visual clues alone are no longer reliable.

• Watch for odd blinking, blurred edges or lips out of sync.
• Ask who first posted it and whether trusted news outlets report it.
• Check for content credentials or AI labels.
• Be extra cautious if it asks for money or urgent action.

Read: How to spot deepfakes

Smart home devices are generally safe if you choose reputable brands, keep them updated and secure the accounts that control them. The main risks come from default passwords, abandoned products that stop receiving updates and weak app passwords.

Before buying, check how long the maker promises security updates. Use a strong unique password with two-step verification on the app, and if your router allows it, put smart devices on a separate guest network.

Read: Are smart home devices safe?

Buy from well-known retailers, pay with a credit card or trusted payment service, and be wary of prices that seem too good to be true. Credit cards and services such as PayPal usually offer better protection if goods never arrive.

• Type the shop address yourself rather than clicking ads in messages.
• Check reviews from independent sites.
• Never pay by bank transfer to an unknown seller.
• Use two-step verification on shopping accounts.

Read: Safe online shopping

Combine sensible device settings with open, regular conversations about what children do online. Technical controls help, but children are safest when they feel able to tell you if something worries them.

• Use built-in parental controls on phones, consoles and the home router.
• Set apps and games to private and limit who can message them.
• Agree simple family rules on screen time and sharing photos.
• Teach them never to share passwords or meet online contacts alone.

Read: Protecting children online: a guide for parents

Your browser first asks DNS to translate the name into an IP address, then connects to that server, sets up an encrypted HTTPS session and requests the page. The server sends back HTML, images and scripts, which your browser assembles into what you see.

All this usually happens in well under a second. If a site will not load, the fault could be at any step, for example a DNS problem, a blocked connection or the server itself being down.

Read: What happens in the second after you open a website

Your email app sends the message to your provider's outgoing mail server, which looks up the recipient's mail server using DNS and passes it on using SMTP. The recipient's provider stores it until their app collects it with IMAP or a web interface.

Along the way, checks such as SPF, DKIM and DMARC help confirm the message really came from the domain it claims, which is how many spoofed and scam emails are caught.

Read: How an email gets from one inbox to another

Many phones automatically switch to mobile data when the Wi-Fi signal is weak or the connection seems not to reach the internet. Features called Wi-Fi Assist on iPhone or adaptive connectivity on Android are designed to keep apps working smoothly.

You can turn these features off in settings if you have a small data allowance. Also check whether the Wi-Fi network needs you to sign in, and whether particular apps are allowed to use mobile data in the background.

Read: How mobile data works: masts, SIMs and signal bars