🚧 Under construction — VoTechWorks is being built. A free tech program — complimentary, as our commitment to get America working.
voTechWorksGrade 13 · a vocational technology learning center, by urbanicity
newSchoolWorks.com › VoTechWorks › Technology & Design › Cybersecurity › Universal Core: Safety, Workplace Math, Communication & Career Readiness for Cybersecurity › Lesson 3
TEC-CYBE44-01 · Lesson 3 · 28 clock hours · practice

Trade Math for Cybersecurity: Number Systems, Subnetting, and Data Metrics

Objective. Students will convert values among binary, decimal, and hexadecimal number systems and perform basic IPv4 subnet calculations — including CIDR notation, usable host counts, and network/broadcast address identification — at the accuracy level required for Security+ and CySA+ exam questions.

⚠ Pending professional review

This lesson, its worked examples and its practice questions has not yet been verified by an industry-certified professional or by a certification or approval body. It is a study draft and may contain errors. Do not use it as instructions for work on a job site or on live equipment. Always follow your instructor, your supervising professional, and current official references and regulations.

VoTechWorks program approval and accreditation are still in progress. Credentials are issued only by the certifying bodies named in each program, after their own exams.

Why Math Matters in Cybersecurity

Cybersecurity is not only a technical discipline — it is a quantitative one. Network engineers, security analysts, and incident responders routinely read IP addresses, interpret traffic logs, and segment networks. Every one of those tasks requires fluency with number systems and basic arithmetic. CompTIA Security+ and CySA+ both include questions that expect you to perform these calculations quickly and accurately. This lesson builds that foundation.

Number Systems: Binary, Decimal, and Hexadecimal

Computers store and transmit everything as binary — sequences of 1s and 0s. Humans prefer decimal. Network protocols and memory addresses often use hexadecimal (hex) as a compact shorthand. You must move comfortably among all three.

Binary (Base 2): Each digit (bit) is either 0 or 1. Place values double from right to left: 1, 2, 4, 8, 16, 32, 64, 128. An 8-bit group is called a byte or octet.

Decimal (Base 10): The everyday system. Place values are powers of 10.

Hexadecimal (Base 16): Uses digits 0–9 and letters A–F (A=10, B=11, C=12, D=13, E=14, F=15). One hex digit represents exactly four bits (a nibble). Two hex digits represent one byte. Hex values are often written with a leading `0x` (for example, `0xFF`) or a trailing `h`.

Converting Binary to Decimal

Write out the bit positions (128, 64, 32, 16, 8, 4, 2, 1) above each bit. Multiply each bit by its position value, then add the results.

Converting Decimal to Binary

Repeatedly divide the decimal number by 2, recording the remainder each time. Read the remainders from bottom to top.

Converting Hex to Decimal

Multiply the left hex digit by 16, add the right hex digit (converting A–F to 10–15 first).

Converting Binary to Hex

Split the binary string into 4-bit groups from right to left. Convert each group to its hex digit. This is the fastest path when working with MAC addresses, color codes, or memory dumps.

IPv4 Addressing and CIDR Notation

An IPv4 address is 32 bits written as four octets in decimal, separated by dots — for example, `192.168.10.0`. CIDR (Classless Inter-Domain Routing) notation appends a slash and a number showing how many leading bits belong to the network portion — for example, `/24` means the first 24 bits identify the network, leaving 8 bits for hosts.

Subnet Mask Basics

A subnet mask is 32 bits: all network bits are 1, all host bits are 0. `/24` = `255.255.255.0`. `/25` = `255.255.255.128`. `/26` = `255.255.255.192`. `/27` = `255.255.255.224`. `/28` = `255.255.255.240`.

Key Calculations for Any Subnet

Why Subnetting Is a Security Control

Network segmentation — dividing a large flat network into smaller subnets — limits the blast radius of an attack. If malware infects one subnet, proper firewall and routing rules can contain it there. Security+ maps this directly to the Network Security domain. Knowing subnetting lets you evaluate whether a proposed network design actually isolates sensitive systems.

Data Metrics: Bits, Bytes, and Throughput

Traffic analysis requires converting among units of data volume and rate. The key relationships are:

When a traffic report mixes units, convert everything to the same unit before comparing. An interface pushing 900 Mbps on a 1 Gbps link is at 90% utilization — a potential bottleneck or a sign of data exfiltration. CySA+ expects analysts to flag statistically abnormal traffic volumes as part of Threat and Vulnerability Management.

Accuracy and Exam Readiness

On the Security+ and CySA+ exams, there is no partial credit — a wrong subnet boundary means a wrong answer. Practice without a calculator first; use one only to verify. Identify which step caused an error (place value? forgetting to subtract 2?) and drill that step specifically. Reaching 90% accuracy on conversion drills and 80% on the quiz is the standard for this lesson.

Key terms8

OctetA group of 8 bits; one of the four groups that make up an IPv4 address, written as a decimal number between 0 and 255.
CIDR notationClassless Inter-Domain Routing notation; expresses a network address and its subnet mask as a single value using a slash and bit count, for example 192.168.1.0/24.
Subnet maskA 32-bit value that separates the network portion of an IP address from the host portion; network bits are all 1s, host bits are all 0s.
Network addressThe first address in a subnet, where all host bits are set to 0; it identifies the subnet itself and cannot be assigned to a host.
Broadcast addressThe last address in a subnet, where all host bits are set to 1; packets sent to this address are delivered to every host on the subnet.
HexadecimalA base-16 number system using digits 0–9 and letters A–F; one hex digit represents four bits, making it a compact notation for binary data.
ThroughputThe actual rate at which data is successfully transferred across a network link, expressed in bits per second (bps) or multiples such as Mbps or Gbps.
Network segmentationA security control that divides a network into smaller subnets to limit lateral movement by attackers and contain the impact of a breach.

Worked examples4

1. Convert the binary number 10110101 to decimal.
  1. Write out the 8 place values from left to right: 128, 64, 32, 16, 8, 4, 2, 1.
  2. Align each bit under its place value: 1, 0, 1, 1, 0, 1, 0, 1.
  3. Multiply each bit by its place value: 1×128=128, 0×64=0, 1×32=32, 1×16=16, 0×8=0, 1×4=4, 0×2=0, 1×1=1.
  4. Add the results: 128 + 0 + 32 + 16 + 0 + 4 + 0 + 1 = 181.
Answer: 181
2. Convert the hexadecimal value 0xB4 to decimal.
  1. Identify the two hex digits: B and 4.
  2. Convert B to decimal: B = 11.
  3. Multiply the left digit by 16: 11 × 16 = 176.
  4. Add the right digit: 176 + 4 = 180.
Answer: 180
3. For the network 192.168.10.0/26, find the subnet mask, broadcast address, valid host range, and number of usable hosts.
  1. /26 means 26 network bits and 6 host bits. The subnet mask is 255.255.255.192 (the fourth octet in binary is 11000000 = 192).
  2. Number of addresses: 2^6 = 64. Usable hosts: 64 − 2 = 62.
  3. Network address: 192.168.10.0 (all host bits = 0).
  4. Broadcast address: 192.168.10.63 (all host bits = 1; 0 + 63 = 63).
  5. Valid host range: 192.168.10.1 through 192.168.10.62.
Answer: Subnet mask: 255.255.255.192 | Network: 192.168.10.0 | Broadcast: 192.168.10.63 | Hosts: 192.168.10.1–192.168.10.62 | Usable host count: 62
4. A traffic report shows Interface A transferring 1.2 GB per second and Interface B transferring 9,600 Mbps. Which interface has higher throughput, and by how much?
  1. Convert Interface A to Mbps: 1.2 GB/s × 1,000 MB/GB × 8 bits/byte = 9,600 Mbps.
  2. Interface B is already in Mbps: 9,600 Mbps.
  3. Compare: 9,600 Mbps = 9,600 Mbps — the interfaces have equal throughput.
  4. Note: this example shows why converting to a common unit before comparing is essential; the values looked different but are identical.
Answer: Both interfaces have equal throughput of 9,600 Mbps (9.6 Gbps). Neither is higher than the other.

The math in this lesson2

Learners convert binary 10110101 to decimal 181 by place value and convert among hex, binary and decimal.
F-LE.1N-Q.1
Brush up in the math halls at newSchoolWorks.com:
In class: Complete a structured drill set of 40 binary-to-decimal, decimal-to-binary, and hex-to-decimal conversion problems (no calculator), self-check against an answer key, identify error patterns, and repeat until achieving 90% accuracy on a second set. · Using a printed IPv4 subnetting worksheet, calculate the network address, broadcast address, valid host range, and number of usable hosts for ten /24–/28 CIDR blocks; verify answers with a subnetting reference chart and discuss why subnetting knowledge supports network segmentation as a security control (mapped to Security+ domain: Network Security). · Interpret a sample network traffic report that expresses data volumes in bits, bytes, kilobytes, megabytes, and gigabytes per second; convert all values to a common unit, rank interfaces by throughput, and write two sentences explaining which interface poses the highest anomalous-traffic risk — connecting quantitative reasoning to threat analysis (mapped to CySA+ domain: Threat and Vulnerability Management).
Materials: IPv4 subnetting reference worksheet, binary/hex conversion drill sheets, calculator (for verification only after manual calculation), CompTIA Security+ Exam Objectives (current version, free download from CompTIA.org), CompTIA CySA+ Exam Objectives (current version)
Check: Students complete a 20-question trade math quiz — 10 number-system conversions and 10 subnetting calculations — and score 80% or higher with all work shown; any score below 80% triggers a targeted remediation set before the next lesson.

Practice check8

Answer each question, then check it. Nothing is recorded; this is your own practice.

CompTIA Security+ — General Security Concepts / Network Security
1. What is the decimal value of the binary number 11001010?
CompTIA Security+ — General Security Concepts / Network Security
2. Which binary string correctly represents the decimal value 219?
CompTIA Security+ — General Security Concepts
3. What is the decimal equivalent of the hexadecimal value 0xAF?
CompTIA Security+ — Network Security
4. A network is defined as 10.0.0.0/28. How many usable host addresses does this subnet provide?
CompTIA Security+ — Network Security
5. For the subnet 172.16.5.0/27, what is the broadcast address?
CompTIA CySA+ — Threat and Vulnerability Management
6. An analyst reviews a traffic log. Interface X shows 800 Mbps and Interface Y shows 0.9 Gbps. Which interface has higher throughput?
CompTIA Security+ — Network Security
7. A security architect wants to segment a data center into subnets of no more than 30 usable hosts each. Which CIDR prefix length should she apply?
CompTIA CySA+ — Threat and Vulnerability Management
8. An intrusion analyst converts a packet capture timestamp field from hexadecimal 0x3C to decimal to match a SIEM log. What decimal value should be recorded?
Record this lesson on my transcript. Sign in with your key and enrollment email to record lessons (enroll free if you have no key). This page stays open to read and practise.
← Previous lessonProgram planNext lesson →