C5-OSH-11 Operating Systems and Hardware
Full Worked Reference with Model Answers

A wireless local area network replaces the cable between device and switch with radio communication governed by the IEEE 802.11 family of standards. The practical consequence for Botho University is that capacity becomes a shared and contested resource: 800 staff moving between seven buildings compete for airtime on channels that neighbouring campuses in the same urban block are also using. On 2.4 GHz only three non-overlapping channels exist, and in a dense urban environment all three are typically saturated. The design in Section 6 therefore plans primarily on 5 GHz and 6 GHz, where 25 and 59 non-overlapping channels respectively are available and where 802.11ax uses OFDMA to serve many devices in one transmission opportunity rather than one at a time (IEEE, 2021).

Communication across the campus follows the TCP/IP stack: applications produce data, TCP or UDP segments it, IP addresses it, Ethernet or 802.11 frames it, and the physical medium carries the bits. The meaningful design question is where each layer is enforced. Within a building, a layer-2 switch forwards frames between ports on the same VLAN; between buildings and between VLANs, a layer-3 device routes packets and applies policy. The design therefore needs a clear boundary between what shares a broadcast domain and what does not, and that boundary is the VLAN plan implemented in Section 3.3 and shown in the logical diagram in Section 6.2.

An operating system manages the hardware abstraction, the process scheduler, memory, the filesystem and the security boundary between users. In this project the choice of OS is a procurement constraint, not an academic preference. The 15 StartUp Hub workstations arrive with no OS and no drivers, so whichever OS is chosen must have certified drivers for the motherboard chipset, the NVMe controller and the network interface before the first unit can be imaged. That requirement alone eliminates any OS without a hardware compatibility list covering this specific build, and it is why Section 3 recommends a primary OS whose vendor list explicitly names every component in the bill of materials.

The hardware layer sets the ceiling on everything above it. A workstation with 8 GB of RAM running Windows 11, a browser with several tabs and a video call is already below the working set of the applications it must run, which forces paging to disk and produces the slow-computer complaint that dominates helpdesk tickets in most universities. The component choices in Section 2 are therefore driven by what the OS and applications actually consume at peak, not by the minimum the OS vendor will accept. A machine that meets the minimum will run; a machine that meets the working set will remain productive across a four-year refresh cycle.

Neither a wired-only nor a wireless-only design meets the requirement. A wired-only campus cannot support 800 staff who move between seven buildings, and it cannot support laptops used in corridors, meeting rooms and the StartUp Hub. A wireless-only campus cannot carry the inter-building backhaul: aggregate traffic between buildings over a wireless bridge is limited by shared airtime, weather and interference from neighbouring networks, and no wireless bridge carries a 10 Gbps aggregate reliably in a dense urban spectrum. The design therefore uses three layers. Single-mode fibre between buildings provides deterministic backhaul. Wi-Fi 6 inside each building provides mobility for the 1200 concurrent devices. Wired Cat 6A on the last 90 metres serves the devices that need PoE or guaranteed bandwidth: access points, printers and the 15 workstations.

The 15 workstations will run Windows 11 Pro, a browser with several tabs, Microsoft Office and endpoint protection concurrently, and the working set of that combination routinely exceeds 8 GB. Once physical memory is exhausted the OS pages to disk; on an SSD the penalty is measurable, and on an HDD it is the difference between a machine that feels usable and one that does not. Sixteen gigabytes in a 2 x 8 GB dual-channel configuration also doubles effective memory bandwidth against a single 16 GB stick, which matters because these build units will use integrated graphics. The additional cost of roughly BWP 650 per unit, about BWP 9 750 across the 15 workstations, is small against rebuilding the fleet in year two because users cannot work.

A 1 TB 7200 rpm HDD delivers roughly 150 MB/s sequential read at 1 to 2 ms access time; a 512 GB NVMe SSD over PCIe 4.0 delivers roughly 3000 MB/s sequential read at access times measured in microseconds. The practical difference is boot time, application launch and file operations, all of which dominate the user's perception of speed. The SSD has no moving parts, which matters in a portable device carried between buildings and occasionally dropped. The 512 GB capacity is adequate because user data will be redirected to the file server in Section 6, so the larger HDD capacity buys nothing the design needs and costs the user the responsiveness the design does need.

Wi-Fi 5 (802.11ac) serves one client per transmission opportunity and uses MU-MIMO only on the downlink, which in an open-plan office with 60 or more devices on one AP produces high contention and unpredictable latency. Wi-Fi 6 (802.11ax) adds OFDMA, which splits each channel into resource units so that many low-bandwidth devices are served in the same transmission, and adds BSS colouring, which lets an AP distinguish its own transmissions from a neighbouring AP's on the same channel. In a dense urban block where seven buildings and at least one neighbouring campus share the 5 GHz band, BSS colouring alone reduces the effective interference. WPA3-Enterprise replaces the WPA2 four-way handshake, which is vulnerable to offline dictionary attack against a captured handshake, and is mandatory for the staff SSID.

Fifty Wi-Fi 6 access points, 4x4, PoE+, WPA3-Enterprise, deployed at one per 30 to 35 concurrent devices with a 15 percent spare factor. Managed PoE+ access switches with 10G uplinks, because APs need power over the same cable and the 802.1X and VLAN design requires a managed switch. A redundant core pair and firewall pair, because a single core failure isolates a building. Single-mode fibre between buildings in a ring, because it is immune to weather and spectrum contention and can be upgraded to 40G later without recabling. UPS on core and access switches per building, because urban distribution networks have brownouts and PoE APs die without mains power.

Windows 11 Pro is the only one of the three that combines mature central management through Active Directory, Group Policy and Intune with broad application compatibility. At Botho the 800 staff laptops and 15 workstations must run Microsoft Office, the finance system, the library management system and various line-of-business tools whose vendors support Windows and only Windows. Pro rather than Home is non-negotiable because Home cannot join a domain, cannot be managed by Group Policy, and does not support BitLocker or Credential Guard. The cost is real, in per-device licensing, Windows Server CALs and the TPM 2.0 requirement that raises the laptop unit price, but the management capability it buys is what makes 800 devices supportable by a small IT team.

Ubuntu 24.04 LTS is the strongest choice for the server tier. It is free, has five years of standard support and up to twelve with Ubuntu Pro, has excellent support for the directory, DNS, DHCP, RADIUS, file and print services this design needs, and its security posture through AppArmor, Secure Boot and routine patching is well understood. As a desktop OS it is a weaker fit: most administrative staff are trained on Windows, the finance system may not have a Linux client, and the training cost across 800 users would likely exceed the licence saving. It is the right OS for the twelve servers in Section 6 and the wrong OS for the user-facing fleet.

ChromeOS Flex is the right tool for the specific job of shared kiosk devices in reception and the StartUp Hub, where users need a browser and nothing else. It is free, managed from a web console with near-zero local administration, encrypted by default, and its verified boot means a compromised device recovers to a known good state. It is the wrong choice for 800 staff laptops because it cannot run the locally installed applications those staff require, and it cannot join the domain the way the other two can. Choosing it for the kiosk fleet is not fence-sitting: it is the OS that best fits that tier and only that tier.

Windows 11 Pro on the 800 staff laptops and the 15 workstations, Ubuntu Server 24.04 LTS on the server tier, and ChromeOS Flex on a small kiosk fleet. The primary OS for the user-facing fleet is Windows 11 Pro, and that is what the question asks for. The other two are chosen for the specific tiers where their strengths are decisive: Ubuntu because the server tier must be free, stable and scriptable; ChromeOS Flex because the kiosk tier must be near-zero administration. Management across the fleet is centralised through Active Directory for Windows devices, Landscape and Ansible for Ubuntu servers, and the Google Admin console for the kiosks.

Windows 11 Pro is licensed per device, typically OEM with the laptop or through a volume agreement with Software Assurance if the fleet will be refreshed on a cycle. Windows Server is licensed per core plus Client Access Licences; two domain controllers and one file and print server at 16 cores each need 32 core licences and 800 user CALs. Ubuntu Server is free, with Ubuntu Pro optional for extended security maintenance and support. ChromeOS Flex is free, with Chrome Enterprise Upgrade needed only for the kiosk fleet that must be centrally managed. Endpoint protection is a per-device subscription across all 815 devices plus the servers, and it is budgeted in the BOM in Section 2.3.

The campus is allocated 10.20.0.0/16, which gives 65 534 usable host addresses and room for every VLAN in the plan plus future growth. The STAFF VLAN is a /22 because 800 staff devices plus phones plus headroom exceeds a /24; every other VLAN is a /24 because its device count is bounded. Printers receive static reservations in DHCP rather than manually typed addresses, so a replacement printer needs one record change and not a site visit. Access points and switches are static in the MGMT VLAN because they must be reachable when DHCP is unavailable. The QUARANTINE VLAN exists so that a device failing 802.1X or posture check lands somewhere harmless rather than on the staff network.

DHCP assigns addresses and reservations. DNS resolves names and is AD-integrated. NTP keeps every device within Kerberos' five-minute tolerance. LDAP and Kerberos authenticate users. RADIUS with 802.1X authenticates devices to the wireless and to switch ports. HTTPS and IPP over TLS protect management and printing. SNMPv3 provides authenticated monitoring. LLDP exposes the physical topology and negotiates PoE. RSTP or MSTP prevents loops in the redundant inter-building fibre. OSPF or static routing handles the core. QoS with DSCP marks voice above bulk data. And 802.11k, 802.11v and 802.11r make roaming between access points seamless enough that a Teams call survives a walk between buildings.

Three compatibility chains matter. Windows 11 Pro requires TPM 2.0 and UEFI Secure Boot, so the laptop BOM must include TPM and this affects unit cost. WPA3-Enterprise requires an OS supplicant that supports it, which Windows 11 and Ubuntu 24.04 do, but older Android devices may not, which is why a transitional WPA2-Enterprise SSID may be needed for a defined period. The three printers must support IPP over TLS and 802.1X, or they must be placed on the PRINT VLAN with MAC authentication bypass. That last point is checked before the printers are commissioned, and it is the kind of practical compatibility detail that is easy to miss and expensive to fix after installation.

The reliability target is that no single device failure isolates a building. This is met by stacking the two core switches or pairing them in MLAG, by dual power supplies in the core and servers, by RAID 10 on every server, by UPS protection on core and access switches in every building, and by carrying the inter-building fibre in a ring rather than a star so that a single cut does not split the campus. Reliability is measured by MTBF from the vendor data sheet for each device class and by MTTR from the incident log; the RAID rebuild should be tested once so that the documented time is real rather than the vendor's best case.

The availability target is 99.9 percent during 07:00 to 18:00, which allows about 2.3 hours of unplanned downtime in working hours per year. This is met by redundant core and edge, two domain controllers, DHCP failover, a redundant wireless controller, a second internet path over fibre plus LTE failover, and maintenance windows outside teaching hours. Availability is measured by SNMP polling of the core and edge devices at one-minute intervals, with monthly reporting of the percentage and a list of every outage with duration and cause. A 99.9 percent target that is not measured is a wish; the polling interval and the incident log are what make it a requirement.

The security target is no shared wireless key, every device authenticated, and data encrypted at rest and in transit. This is met by WPA3-Enterprise with 802.1X and RADIUS, by the VLAN segmentation in Section 6.2 with firewall rules between zones, by BitLocker on Windows and LUKS on Ubuntu, by endpoint detection and response on every device, by printer hardening, and by multi-factor authentication on all administrative access. It is measured by failed authentication attempts per day, percentage of devices passing posture check, patch compliance percentage, and the count of open critical vulnerabilities from the vulnerability scanner, all reported monthly to the IT steering group.

The performance targets are under 1 ms latency to the access switch on wired, under 10 ms on wireless to the gateway, at least 20 Mbps per active device at peak, and under 2 s response time for the student information system. These are met by Wi-Fi 6 on 5 GHz and 6 GHz at one AP per 30 to 35 devices, by 10G uplinks per building, by QoS marking for voice, by content caching at the edge, and by sizing internet bandwidth from a measured peak-hour baseline rather than from an assumption. They are measured by ping and iperf3 between sample hosts, by per-AP throughput and retry statistics from the controller, by browser timing captures against the SIS, and by peak concurrent device count from the wireless controller.

Five constraints shape this design. The budget ceiling forces phasing, so the deployment plan puts the highest-density buildings first and publishes the schedule. Building age and fabric limit cable routes: some buildings have no containment, and one has a heritage listing that prevents drilling, so the inter-building links to that building use external armoured fibre. The 100-metre copper limit means large floors need an intermediate distribution frame or fibre to the floor, which is why the design specifies fibre from the building distribution to each floor. Power and cooling in older buildings cap the PoE budget and the number of servers that can be racked, so the PoE load per building is calculated before switches are ordered. And urban radio spectrum is contested, which is why the design plans on 5 GHz and 6 GHz with low transmit power and BSS colouring.

Symptom. A user reports that wireless connects but is slow and occasionally drops during video calls.

Possible causes. Four are plausible: co-channel interference or insufficient AP density in that area; the client stuck on the 2.4 GHz band; a roaming misconfiguration in which the client hangs on to a distant AP instead of moving to a closer one; and channel width set to 80 or 160 MHz, which is too wide for the density and causes co-channel overlap.

Diagnosis. First, check the client's negotiated band, channel, RSSI and SNR from the OS, using netsh wlan show interfaces on Windows or iw dev on Linux. Second, from the wireless controller, look at the AP serving that area: channel utilisation, retry rate and client count. Third, run a passive site survey in the same location with a known good client to see whether the problem follows the client or the location. Fourth, check the controller's roaming settings and the channel width plan for that floor.

Tools and justification. The client's own interface statistics separate a client problem from an infrastructure problem in one step, which determines where to spend the next twenty minutes. The controller statistics show airtime utilisation and retries, which distinguish a coverage problem from an interference problem: low RSSI everywhere is coverage, high RSSI with high retries is interference. A site survey is the only way to see the actual radio environment including neighbouring networks.

Resolution in this case. The client was on 2.4 GHz at minus 72 dBm while a 5 GHz AP was four metres away. The roaming threshold was set too low, so the client never moved. Raising the minimum RSSI to minus 67 dBm and disabling 2.4 GHz on that floor's SSID resolved the issue, and both changes are now part of the standard configuration template for every building.

Symptom. Jobs from one printer stay in the queue and never reach the device, and subsequent jobs from the same printer queue also fail.

Possible causes. The print spooler service has hung; one corrupt job is blocking the queue behind it; the driver on the client does not match the driver the server expects; the printer is offline, out of paper or unreachable on the network.

Diagnosis. Check the printer panel first, because an offline printer produces the same symptom as a hung spooler. Then check the queue for a job with an error status. Restart the Print Spooler service. If the queue remains blocked, stop the spooler, clear the contents of C:\Windows\System32\spool\PRINTERS, and restart it. If one client can print and another cannot, remove and re-add the printer on the failing client with the driver the server publishes.

Tools and justification. The spooler is the first suspect because it serialises every job, so one corrupt job blocks everything behind it. Event Viewer under Applications and Services Logs records the spooler error code, which identifies whether the failure is a rendering error in a specific driver or a connectivity error to the device. Restarting the service is reversible, fast and non-destructive, which is why it comes before any driver change.

The campus uses a three-tier topology. Two core switches, stacked or paired in MLAG, sit in the main building and provide layer-3 routing between VLANs and between buildings. Each building has a distribution switch connected to both cores over a 10G single-mode fibre link, and the fibre is run in a ring (Building 1 to 2 to 3 to 4 to 5 to 6 to 7 to 1) so that a single cut does not isolate a building. Each building has two 24-port PoE+ access switches with 10G SFP+ uplinks to the distribution switch. The PoE+ budget per switch of 370 W is enough for eight Wi-Fi 6 access points at 25 W each with headroom for cameras and desk phones. Access points are Wi-Fi 6, 4x4, PoE+, mounted one per 30 to 35 concurrent devices, with channel and power plans set from a site survey rather than from defaults.

The 15 workstations sit on the HUB VLAN in the StartUp Hub in Building 1, because their security posture and update cycle differ from the staff fleet. The three printers sit on the PRINT VLAN with static DHCP reservations, because printers are the devices most likely to drift off their assigned address and least likely to be noticed when they do. Guest devices land on an isolated GUEST VLAN with internet-only access and client isolation, so a visitor cannot reach another visitor's device. Servers sit on the SERVERS VLAN behind firewall rules that allow only the ports each service publishes. Access points and switches sit on MGMT, which has no route to the internet and is reachable only from the management host.

The scale argument is arithmetic. 800 staff at an average of 1.5 devices each is about 1200 concurrent devices at peak. At a Wi-Fi 6 density target of 30 to 35 concurrent devices per AP, that is 34 to 40 APs, plus a 15 percent spare factor, which is 40 to 46; the design carries 50 to leave room for growth. Eight APs per access switch fits the 370 W PoE budget with margin. At 300 Mbps of useful throughput per AP at peak, aggregate wireless capacity is roughly 15 Gbps, which the 10G uplinks and the core can carry without becoming the bottleneck. Internet bandwidth is sized from the measured peak-hour baseline rather than from a per-user allowance, because a 20 Mbps per-user figure applied to 1200 devices would produce an absurd and unaffordable number.

BitLocker encrypts the full volume using a key protected by the TPM, and requiring a PIN at boot means the key is released only when the user enters it. The threat addressed is the stolen or lost laptop, which is the most common cause of a reportable data breach in a university setting. The control is effective because the data on a stolen device is unreadable without the PIN, and the recovery key is escrowed in Active Directory so that an authorised administrator can recover a device when the user has forgotten the PIN. Its contribution to the overall security posture is to reduce the breach-notification burden and to satisfy the data protection requirement that personal data be protected at rest.

The staff SSID uses WPA3-Enterprise, which authenticates each device against the RADIUS server with the user's domain credentials before the device is allowed to associate, and derives a unique session key per device. The threat addressed is the rogue device joining the staff network with a shared key, and the WPA2 offline dictionary attack against a captured handshake. The control is effective because there is no shared key to leak, the RADIUS log records every successful and failed authentication, and the unique session key per device removes the passive decryption path that WPA2-PSK allowed. Its contribution is to make the wireless network a named-user network rather than a shared-secret network, which changes the nature of incident response from "who had the key" to "who authenticated at this time".

Each function (staff, hub, voice, print, guest, servers, IoT, quarantine) sits on its own VLAN, and the firewall between VLANs enforces policy: GUEST reaches the internet only, IOT cannot reach STAFF, PRINT accepts IPP over TLS only from STAFF and SERVERS, and QUARANTINE reaches nothing until a device passes posture check. The threat addressed is lateral movement after a compromise: an infected staff laptop cannot reach the file server over SMB, cannot reach the printer management interface, and cannot reach the IoT cameras. The control is effective because policy is enforced at the routing boundary and does not depend on endpoint compliance, and it is verifiable by a ping test from each zone to every other zone, which is shown in the evidence.

Technical controls raise the cost of an attack; training lowers the chance that the weakest link is a person. The programme has four modules. Phishing recognition runs at induction and is reinforced by a quarterly simulated campaign, with a report rate above 70 percent and a click rate below 5 percent as success measures. Password and MFA practice runs at induction, with MFA enrolment above 95 percent as the measure. Device handling is a one-page guide and a poster in every building, with lost-device reports within one hour as the measure. Data handling and incident reporting are annual refreshers, with mean time to report a suspected incident as the measure. Every measure is reported to the IT steering group quarterly alongside the technical metrics in Section 4.3.

The policy for the 800 normal users is a minimum of 12 characters, no forced rotation, no composition rules, a blocked list of common and breached passwords, MFA, lockout after five failures for 15 minutes, and a 10-minute screen lock. Length is the dominant factor in resisting brute force and offline cracking (NIST, 2017), and 12 characters of any kind is stronger than 8 characters with complexity. Removing forced rotation removes the predictable increment pattern that users adopt when forced to change, which is exactly what attackers attempt first. A blocked list stops the passwords that appear in every breach corpus, such as 123456, Password1 and Summer2026. MFA means a stolen password is not sufficient for access. Lockout at five failures with a 15-minute window slows brute force without creating a denial-of-service. The usability effect is a net improvement: no forced changes, a passphrase of three or four words is easy to remember, and MFA on a trusted device can remember the session for a defined period.

Service accounts use 32 random characters, interactive logon disabled, unique per service, stored in a vault, rotated on a schedule and on staff change, and scoped to the least privilege the service needs. No human has to remember these, so length and randomness cost nothing. Disabling interactive logon removes the attack path where an attacker logs in as the service account and escalates from there. The vault makes rotation automated, which is what makes it happen. The specific threat reduced is Kerberoasting, in which an attacker requests a service ticket and cracks it offline: a 32-character random password with a short rotation window makes that crack infeasible within the life of the credential.

Each administrator has a separate admin account from the daily-use account, with a 16-character minimum and MFA on every elevation. Administrative sessions run from a hardened management host. The design uses just-in-time elevation with a defined time limit and a log of every elevation. The threat addressed is the phishing or credential-theft attack on the daily account that would otherwise yield domain rights. The cost is real: two accounts, an extra authentication step, and a management host. That cost is deliberate friction on privileged actions, and it is the friction that makes the privileged account worth protecting.

Local admin passwords are unique per device, 20 characters, vaulted, and rotated automatically. Domain administrator credentials are held in the vault and used only from the management host. Root on Ubuntu is restricted to console or the management network. A break-glass account exists, sealed, with the seal logged and every use audited. The threat addressed is lateral movement using a shared local admin password, which is the most common path from a single compromised workstation to domain compromise. The uniqueness removes that path. The break-glass account exists so that a genuine emergency does not tempt staff to weaken controls under pressure, which is the failure mode that kills every well-designed policy in practice.

A weak policy in this environment would be 8 characters, forced 90-day rotation, upper/lower/digit/symbol composition, no lockout, no MFA, the same admin account for daily use, and service accounts treated as users. Each element fails against a specific threat. Eight characters falls to brute force and to offline cracking of a stolen hash in hours. Forced rotation produces incremental patterns such as Winter2025 and Spring2026, which appear in cracking wordlists. Composition rules produce P@ssw0rd, which passes the rule and falls in seconds. No lockout allows unlimited attempts. No MFA means a phished password is a compromise. The same admin account for daily use turns a phishing email into domain control. Service accounts treated as users produce shared passwords that are never rotated and appear in Kerberos ticket attacks. The proposed policy addresses each of these with a rule chosen for the threat it reduces, and the usability effect is a net improvement because the friction is concentrated where it matters, on elevation, and removed where it does not, on routine password changes.

The proposed policy removes forced rotation, which reduces helpdesk load and user frustration, and adds MFA and a vault, which increases first-week effort and the support burden during rollout. Both effects are real and both are stated. The mitigations are phased rollout by building, a password manager provided to all staff, self-service reset, and a communications plan that explains why the changes benefit the user rather than simply announcing them. The measurable targets are a 30 percent reduction in password-reset tickets within two months of rollout, MFA enrolment above 95 percent within one month, and a satisfaction score above 3.5 out of 5 in the post-rollout survey. A policy that improves security but is abandoned by users improves nothing.