Question 1

Identifying TCP/IP Model Layers — From a Mixed List Given the list Application, Session, Transport, Internet, Data Link, Physical, which items are actual layers of the TCP/IP model (considering the canonical 4-layer/5-layer views)?

Accepted Answer

Introduction / Context: Different curricula present the TCP/IP stack as either 4 layers (Application, Transport, Internet, Network Access) or a 5-layer teaching model (Application, Transport, Internet, Data Link, Physical). Distinguishing these from the OSI model prevents layer confusion during troubleshooting and design. Given Data / Assumptions: The mixed list contains OSI and TCP/IP terms: Application, Session, Transport, Internet, Data Link, Physical. We accept the 5-layer teaching view where Data Link and Physical appear separately. We must select only actual TCP/IP layers from the list. Concept / Approach: TCP/IP layers include Application, Transport, Internet, and (in the 4-layer model) Network Access; in a 5-layer view the bottom layer is split into Data Link and Physical. "Session" belongs to OSI and is not represented as a distinct layer in TCP/IP; its functions are handled within the TCP/IP Application layer and by protocols like TCP for sessions. Step-by-Step Solution: From the list, mark Application (1) as valid.Mark Transport (3) as valid.Mark Internet (4) as valid.Do not mark Session (2) because it is an OSI layer.Data Link and Physical can be TCP/IP lower layers (5-layer pedagogy), but the correct option provided here that matches the standard trio is 1, 3 and 4. Verification / Alternative check: Compare common textbooks: TCP/IP (Application, Transport, Internet, Network Access). In 5-layer mapping, Network Access is split into Data Link and Physical, but the answer set targets the classic trio from the provided choices. Why Other Options Are Wrong: 1 and 2: Includes Session, which is not a TCP/IP layer. 2, 3 and 5 / 3, 4 and 5: Either include Session or omit Application. 4 and 6 only: Nonsensical indexing; Physical as "6" is incorrect in the context. Common Pitfalls: Mixing OSI Session/Presentation with TCP/IP Application; in TCP/IP those functions are collapsed. Final Answer: 1, 3 and 4

Question 2

DoD (TCP/IP) Stack — OSI Network Layer Equivalent In the four-layer DoD model (Application, Host-to-Host, Internet, Network Access), which layer corresponds functionally to the OSI Network layer (Layer 3)?

Accepted Answer

Introduction / Context: Cross-mapping OSI and TCP/IP models is a frequent exam topic and helps engineers translate conceptual discussions across documents and vendors. The OSI Network layer is responsible for logical addressing and routing across internetworks. Given Data / Assumptions: We use the DoD 4-layer view: Application, Host-to-Host, Internet, Network Access. OSI Network layer (Layer 3) handles IP addressing, routing, and path selection. We must map functions, not names. Concept / Approach: The DoD Internet layer provides routing and logical addressing (for example, IP, ICMP, routing protocols), matching OSI Layer 3 responsibilities. The Host-to-Host layer aligns with OSI Transport (TCP/UDP), and Network Access aligns with OSI Data Link and Physical. Therefore, the functional equivalent of the OSI Network layer is the Internet layer in the DoD model. Step-by-Step Solution: Identify OSI L3 functions: addressing and routing.Locate those functions in DoD: Internet layer.Exclude Host-to-Host (transport) and Network Access (link/physical).Select Internet. Verification / Alternative check: Protocol placement: IP and ICMP reside in the Internet layer, just as OSI Layer 3 would house network protocols. Why Other Options Are Wrong: Application: Upper-layer protocols and services, not routing. Host-to-Host: End-to-end transport, not network-wide routing. Network Access: Framing and media access, not logical addressing. Common Pitfalls: Confusing the term "Internet" (the global network) with the Internet layer name; here it refers to the TCP/IP layer where IP operates. Final Answer: Internet

Question 3

Transport Protocol Identification — Which Services Use TCP? From the services listed below, select the subset that uses Transmission Control Protocol (TCP) rather than UDP.  DHCP 2) SMTP 3) HTTP 4) TFTP 5) FTP

Accepted Answer

Introduction / Context: Recognizing which applications ride over TCP versus UDP is crucial for firewall rules, troubleshooting, and performance expectations. TCP provides connection-oriented delivery, sequencing, and reliability, while UDP is connectionless with minimal overhead and no built-in reliability. Given Data / Assumptions: Services in question: DHCP, SMTP, HTTP, TFTP, FTP. We assume standard, well-known port behavior. We need to choose only those that use TCP. Concept / Approach: SMTP uses TCP port 25 (and 587/465 variants). HTTP uses TCP port 80 (and HTTPS uses TCP 443). FTP uses TCP ports 20/21 for data/control in active/passive modes. DHCP uses UDP ports 67/68 for lightweight broadcast/relay exchanges; TFTP uses UDP port 69 for simple file transfers without session state. Therefore, the TCP trio is SMTP, HTTP, and FTP (2, 3, 5). Step-by-Step Solution: Classify each service by transport: SMTP → TCP, HTTP → TCP, FTP → TCP.Classify the remaining services: DHCP → UDP, TFTP → UDP.Select the set that includes 2, 3, and 5 only.Confirm ports if needed using standard IANA assignments. Verification / Alternative check: Network traces (for example, with Wireshark) clearly show 3-way handshakes for SMTP/HTTP/FTP and no such handshake for DHCP/TFTP which use UDP. Why Other Options Are Wrong: Options including 1 (DHCP) or 4 (TFTP) are incorrect because both use UDP. Any pair or trio that omits one of SMTP/HTTP/FTP fails to capture the full TCP set among the provided services. Common Pitfalls: Assuming TFTP is TCP because FTP is; despite similar names, TFTP is UDP-based and intentionally minimal. Final Answer: 2, 3 and 5

Question 4

In computer networking, which of the following IPv4 addresses falls within the private address ranges reserved by RFC 1918?

Accepted Answer

Introduction / Context: IPv4 defines special “private” address blocks that can be used inside local area networks without consuming globally routable space. Routers on the public Internet do not forward these addresses. Knowing the exact ranges is essential for subnetting, home/enterprise network design, and troubleshooting Network Address Translation (NAT). Given Data / Assumptions: The question lists four dotted-decimal IPv4 addresses. Private ranges per RFC 1918 are: 10.0.0.0–10.255.255.255, 172.16.0.0–172.31.255.255, and 192.168.0.0–192.168.255.255. Any address outside those ranges is public (barring other special-use blocks). Concept / Approach: Compare each option to the three private blocks and identify which one falls inside. Use inclusive range checks on the second octet for the 172.16/12 block and on the third octet for the 192.168/16 block. Step-by-Step Solution: Check 12.0.0.1: 12.x.x.x is not 10.x.x.x, not 172.16–31, not 192.168.x.x → public.Check 168.172.19.39: First octet 168 does not match any private block → public.Check 172.15.14.36: The private 172 block starts at 172.16.x.x; 172.15 is below → public.Check 192.168.24.43: Matches 192.168.0.0/16 → private → correct. Verification / Alternative check: Quick mask method: 192.168.24.43 AND 255.255.0.0 equals 192.168.0.0; the network is within 192.168.0.0/16, a private block. None of the others match 10/8, 172.16/12, or 192.168/16. Why Other Options Are Wrong: 12.0.0.1: A routable public block owned by providers. 168.172.19.39: Public address space. 172.15.14.36: The private 172 range starts at 172.16, so 172.15 is not private. Common Pitfalls: Confusing 172.15 with 172.16–31 due to similar prefix; forgetting that only 172.16 through 172.31 are private. Also, assuming any 192.x address is private—only 192.168.x.x qualifies under RFC 1918. Final Answer: 192.168.24.43

Question 5

ICMP fundamentals: which statements about Internet Control Message Protocol (ICMP) are correct?

Accepted Answer

Introduction / Context: ICMP (Internet Control Message Protocol) is used by IP devices to send control and error messages, such as “destination unreachable” or “time exceeded.” Understanding what ICMP does and does not do is essential for interpreting ping/traceroute results and diagnosing Layer-3 problems. Given Data / Assumptions: Statement 1: “They acknowledge receipt of a TCP segment.” Statement 2: “They guarantee datagram delivery.” Statement 3: “They can provide hosts with information about network problems.” Statement 4: “They are encapsulated within IP datagrams.” Concept / Approach: ICMP is a companion to IP for signaling errors and informational events. It is not a transport protocol and does not provide reliability guarantees or TCP-style acknowledgments. ICMP messages are carried inside IP packets (protocol number 1). Step-by-Step Solution: Evaluate #1: TCP segments are acknowledged by TCP (ACK flags), not by ICMP → false.Evaluate #2: ICMP does not guarantee delivery; IP remains best-effort → false.Evaluate #3: ICMP messages like destination-unreachable, time-exceeded inform hosts of issues → true.Evaluate #4: ICMP rides directly over IP (protocol 1), thus encapsulated in IP → true. Verification / Alternative check: Ping uses ICMP Echo Request/Reply encapsulated in IP. Traceroute observes ICMP Time Exceeded responses. Neither mechanism acknowledges TCP segments nor guarantees delivery. Why Other Options Are Wrong: 1 only / 2 and 3 / 2, 3 and 4: Any option including #1 or #2 is invalid because ICMP neither acknowledges TCP nor provides reliability guarantees. Common Pitfalls: Confusing ICMP replies (Echo Reply) with TCP ACKs; assuming “control” implies reliability. ICMP itself may be filtered by firewalls, further undermining any notion of delivery guarantees. Final Answer: 3 and 4

Question 6

Transport choices: which of the following application services use UDP rather than TCP? (DHCP, SMTP, SNMP, FTP, HTTP, TFTP)

Accepted Answer

Introduction / Context: Different application protocols choose TCP or UDP based on their needs for reliability, ordering, and speed. Identifying which well-known services use UDP is a common exam and troubleshooting task in networking. Given Data / Assumptions: Candidates: DHCP, SMTP, SNMP, FTP, HTTP, TFTP. UDP is connectionless, best-effort; TCP is connection-oriented and reliable. Concept / Approach: Recall common port/transport pairs: DHCP uses UDP (ports 67/68), SNMP uses UDP (161/162), and TFTP uses UDP (69). SMTP, FTP, and HTTP rely on TCP for reliability and ordered delivery. Step-by-Step Solution: DHCP → UDP (broadcast discovery and lightweight exchanges).SMTP → TCP (reliable email transfer on 25/587/465).SNMP → UDP (simple, low overhead management).FTP → TCP (control on 21, data on 20 or passive ports).HTTP → TCP (classic HTTP/1.1) though modern variants may use QUIC/UDP for HTTP/3, but the classic assumption is TCP.TFTP → UDP (simple, lock-step file transfer on 69). Verification / Alternative check: Remember mnemonic: “D, S, T” (DHCP, SNMP, TFTP) → UDP. Others (SMTP, FTP, HTTP) → TCP. Why Other Options Are Wrong: 2 and 4: Both SMTP and FTP are TCP-based. 1, 2 and 4: Incorrect because SMTP and FTP are not UDP. All of the above: Obviously wrong; not all listed use UDP. Common Pitfalls: Confusing TFTP with FTP; the “T” stands for Trivial and uses UDP. Also, be cautious with modern HTTP/3 using QUIC over UDP; traditional exam contexts still map HTTP to TCP. Final Answer: 1, 3 and 6

Question 7

OSI Layer 4 mapping: which transport protocol underlies a Telnet connection?

Accepted Answer

Introduction / Context: Telnet provides remote terminal access and requires a reliable byte stream to carry interactive text. Selecting the correct Layer-4 protocol helps ensure ordered, error-checked delivery suited for terminal sessions. Given Data / Assumptions: Telnet is a classic application-layer protocol (port 23). It predates SSH and relies on cleartext transport. Transport requirements: ordered, reliable delivery. Concept / Approach: Only TCP provides reliable, connection-oriented delivery in the traditional TCP/IP stack. UDP is connectionless and does not guarantee order or delivery, which is not ideal for interactive remote shells like Telnet. Step-by-Step Solution: Map Telnet's port: 23/TCP.Match needs (reliability, order) to TCP features (sequence numbers, ACKs, retransmission).Confirm IP alone is Layer-3 and “TCP/IP” is a suite label, not a Layer-4 protocol. Verification / Alternative check: Run a port scan or consult IANA port assignments: Telnet is assigned to TCP port 23. UDP 23 is not commonly used. Why Other Options Are Wrong: IP: Network layer, not transport. TCP/IP: A stack name, not a single protocol. UDP: No reliability/ordering guarantees; unsuitable for standard Telnet. Common Pitfalls: Thinking “TCP/IP” is an option equivalent to TCP. It is not; always select the precise layer protocol. Final Answer: TCP

Question 8

TCP/IP model alignment: which TCP/IP layer corresponds functionally to the OSI Transport layer?

Accepted Answer

Introduction / Context: When translating concepts between the 7-layer OSI model and the 4-layer TCP/IP model, it helps to know which layers roughly correspond. The OSI Transport layer (Layer 4) handles end-to-end transport services such as reliability and flow control. Given Data / Assumptions: OSI Transport layer provides TCP/UDP-like services. TCP/IP’s four layers are Application, Host-to-Host (or Transport), Internet, and Network Access. Concept / Approach: Identify which TCP/IP layer provides end-to-end transport. That is the Host-to-Host (sometimes called Transport) layer, where TCP and UDP operate. The Internet layer maps to OSI Network (routing), and Network Access maps to OSI Data Link/Physical. Step-by-Step Solution: Match services: reliability, segmentation, flow control → TCP/UDP.Locate TCP/UDP in TCP/IP model → Host-to-Host layer.Confirm that Application in TCP/IP aggregates OSI Session/Presentation/Application. Verification / Alternative check: Any reference diagram shows TCP and UDP at the Host-to-Host layer, clearly mapping to OSI Transport. Why Other Options Are Wrong: Application: Maps to OSI Layers 5–7 combined. Internet: Maps to OSI Network (Layer 3). Network Access: Maps to OSI Layers 1–2. Common Pitfalls: Confusing “Internet” with “Transport” due to TCP’s name; remember TCP and UDP are not in the Internet layer. Final Answer: Host-to-Host

Question 9

Application-layer protocols: which listed items are TCP/IP protocols operating at the OSI Application layer? (IP, TCP, Telnet, FTP, TFTP)

Accepted Answer

Introduction / Context: Protocols live at different layers with distinct responsibilities. Correctly classifying them aids design and troubleshooting. Application-layer protocols directly serve end-user applications, while lower layers provide transport or routing. Given Data / Assumptions: List includes: 1) IP, 2) TCP, 3) Telnet, 4) FTP, 5) TFTP. OSI Application layer covers end-user services, not transport or network functions. Concept / Approach: Classify each item: IP (Layer 3, Internet), TCP (Layer 4, Transport), Telnet/FTP/TFTP (Application layer). Therefore, the set of application-layer protocols is Telnet, FTP, and TFTP. Step-by-Step Solution: IP → network routing; not application.TCP → transport; not application.Telnet → application (remote terminal).FTP → application (file transfer, TCP based).TFTP → application (trivial file transfer, UDP based). Verification / Alternative check: Check common port assignments: Telnet 23/TCP, FTP 21/TCP (and data ports), TFTP 69/UDP—all classic application services. Why Other Options Are Wrong: 1 and 3 / 1, 3 and 5: Include IP, which is not application-layer. All of the above: Incorrect because IP and TCP are not application-layer protocols. Common Pitfalls: Equating “uses a port” with “application layer.” TCP and UDP use ports but remain transport protocols; the services using them are application-layer. Final Answer: 3, 4 and 5

Question 10

Automated IPv4 client configuration: which protocol assigns IP address, subnet mask, default gateway, and DNS information dynamically?

Accepted Answer

Introduction / Context: Modern networks use dynamic configuration so hosts can join with minimal manual setup. The protocol responsible for leasing addresses and providing additional parameters (mask, gateway, DNS) is a cornerstone of enterprise networking and home routers alike. Given Data / Assumptions: Needed parameters: IP address, subnet mask, default gateway, DNS servers. We compare common protocols: SMTP, SNMP, DHCP, ARP. Concept / Approach: Dynamic Host Configuration Protocol (DHCP) performs IP address allocation and options delivery using a client–server model (typically via UDP ports 67/68). Alternatives listed do different jobs: SMTP handles email, SNMP handles management, ARP resolves link-local MAC addresses. Step-by-Step Solution: Identify the only configuration/lease protocol: DHCP.Recall DHCP options convey mask, router (gateway), DNS, domain search, and more.Exclude other protocols by function. Verification / Alternative check: On a client, ipconfig/renew (Windows) or dhclient (Linux) demonstrates DHCP obtaining all listed parameters automatically from a DHCP server. Why Other Options Are Wrong: SMTP: Email transport. SNMP: Monitoring/management, not address assignment. ARP: Resolves IP→MAC on local link; no configuration distribution. Common Pitfalls: Confusing ARP with DHCP because both operate early in host lifecycle; ARP is link-layer resolution, DHCP is network configuration. Final Answer: DHCP

Question 11

Protocol stack usage: when using Telnet or FTP, what is the highest OSI layer involved in transmitting your application data?

Accepted Answer

Introduction / Context: Telnet and FTP are classic application-layer protocols. When describing “the highest layer you are using,” we refer to where the user-level protocol logic resides, not merely the underlying transport or presentation encoding. Given Data / Assumptions: Telnet provides remote terminal access; FTP provides file transfer. OSI layers above Transport are Session, Presentation, and Application. In most practical mappings, application protocols are said to operate at the Application layer, while Presentation/Session services are either minimal or absorbed by the application in TCP/IP. Concept / Approach: Determine the layer that defines the semantics and commands of Telnet and FTP (for example, FTP commands like USER, PASS, GET). Those belong to the Application layer. The underlying reliability comes from Transport (TCP), but the “highest” layer in use is Application. Step-by-Step Solution: Identify Telnet/FTP as application protocols.Recognize they ride on TCP but define user-level semantics above it.Select Application as the highest layer in use. Verification / Alternative check: IANA assigns application ports (Telnet 23, FTP 21) and RFCs define application commands; this is definitive evidence of Application-layer operation. Why Other Options Are Wrong: Presentation/Session: Often collapsed into Application in TCP/IP stacks and not singled out for Telnet/FTP specifically. Transport: Provides delivery but not the application semantics. Common Pitfalls: Confusing “uses TCP” with “Transport layer is the highest.” The highest layer involved by the application remains Application. Final Answer: Application

Question 12

ICMP truth test: select the correct statements about ICMP behavior and encapsulation.

Accepted Answer

Introduction / Context: ICMP communicates network errors and informational messages among IP hosts and routers. Accurately distinguishing ICMP's capabilities and its encapsulation helps interpret diagnostics like ping and traceroute and avoid incorrect assumptions about reliability. Given Data / Assumptions: #1: “ICMP guarantees datagram delivery.” #2: “ICMP can provide hosts with information about network problems.” #3: “ICMP is encapsulated within IP datagrams.” #4: “ICMP is encapsulated within UDP datagrams.” Concept / Approach: ICMP is neither a reliable transport nor a session protocol; it is carried directly by IP (protocol number 1). It signals problems such as unreachable destinations and TTL expiry, which informs hosts and applications of network issues. Step-by-Step Solution: Evaluate #1: False. IP remains best-effort; ICMP does not add delivery guarantees.Evaluate #2: True. ICMP sends error messages like destination-unreachable.Evaluate #3: True. ICMP payload resides directly in IP packets.Evaluate #4: False. ICMP is not inside UDP; it is its own protocol over IP. Verification / Alternative check: Protocol number reference: ICMP = 1, TCP = 6, UDP = 17. Tools like tcpdump/Wireshark show ICMP directly inside IP, never inside UDP. Why Other Options Are Wrong: 1 only / 1 and 4 / All of the above: These include statement #1 or #4, both incorrect. ICMP offers no delivery guarantees and is not encapsulated in UDP. Common Pitfalls: Assuming any control messaging implies reliability; also confusing ICMP Echo Reply with a transport-layer acknowledgment. Final Answer: 2 and 3

Question 13

ARP variants: which mechanism lets a router answer an ARP request on behalf of a remote host so local senders can reach it via the router?

Accepted Answer

Introduction / Context: Address Resolution Protocol (ARP) maps IP addresses to MAC addresses on a local link. In some designs, a router may need to respond to ARP queries for remote hosts to maintain reachability without readdressing or to bridge legacy segments. This is where Proxy ARP is used. Given Data / Assumptions: Scenario: A local host ARPs for a destination that is not on the same subnet. We want a device to respond so traffic can be sent to a next hop transparently. Router capability: respond with its own MAC for a remote IP. Concept / Approach: Proxy ARP allows a router to “pretend” to be the remote host at Layer 2 by answering ARP with its own MAC. The sender then forwards frames to the router, which routes them onward. RARP performs the inverse mapping (MAC→IP) for diskless hosts, and Inverse ARP is used on NBMA networks (e.g., Frame Relay) to learn Layer-3 addresses from known DLCIs. Step-by-Step Solution: Identify requirement: answer ARP on behalf of another IP → Proxy ARP.Exclude RARP: legacy bootstrapping, not ARP answering for others.Exclude InARP: used to discover network layer addresses on NBMA links. Verification / Alternative check: On Cisco IOS, “ip proxy-arp” enables this behavior on an interface; packet captures show the router replying with its MAC for the remote IP. Why Other Options Are Wrong: Gateway DP: Not a standard ARP mechanism. RARP: Client learns its IP from a server based on MAC—unrelated to proxying. Inverse ARP: NBMA address discovery, not ARP proxy. Common Pitfalls: Using Proxy ARP as a substitute for correct subnetting; it can obscure topology and complicate troubleshooting. Prefer proper default gateways and routing when possible. Final Answer: Proxy ARP

Question 14

Digital systems and number bases: What are the decimal and hexadecimal equivalents of the 8-bit binary value 10011101?

Accepted Answer

Introduction / Context: Converting between binary, decimal, and hexadecimal is a foundational digital-logic and networking skill. Administrators, electronics engineers, and programmers often translate IP masks, register values, and flags across these bases. Here we convert the binary pattern 10011101 to both decimal and hexadecimal. Given Data / Assumptions: An 8-bit binary number: 10011101. Weights of bits from left (most significant) to right (least significant): 128, 64, 32, 16, 8, 4, 2, 1. Hexadecimal groups bits in nibbles (4 bits each). Concept / Approach: To convert binary to decimal, sum the weights of all 1 bits. To convert binary to hexadecimal, group bits into 4-bit nibbles and map each nibble to a hex symbol (0–9, A–F). These methods are deterministic and avoid mistakes caused by mental arithmetic shortcuts. Step-by-Step Solution: Write the bit weights: 1 0 0 1 1 1 0 1 corresponds to 128 64 32 16 8 4 2 1.Identify 1 bits: positions 128, 16, 8, 4, and 1 are set.Compute decimal: 128 + 16 + 8 + 4 + 1 = 157.Group into nibbles: 1001 1101.Map nibbles to hex: 1001 = 9, 1101 = D, so hexadecimal is 0x9D. Verification / Alternative check: Reverse check: 0x9D = 9 * 16 + 13 = 144 + 13 = 157 decimal; 157 in binary is indeed 10011101. Both paths agree. Why Other Options Are Wrong: 155, 0x9B: 0x9B = 155 decimal, not 157. 159, 0x9F: 0x9F = 159 decimal, different set bits (adds +2). 185, 0xB9: 0xB9 = 185 decimal; high nibble B (1011) does not match 1001. 145, 0x91: 0x91 = 145 decimal; too small by 12. Common Pitfalls: Forgetting to use correct bit weights; mis-grouping nibbles from the left; mixing decimal digits with hex symbols (e.g., treating D as 10 instead of 13). Final Answer: 157, 0x9D

Question 15

Computer networks: Which protocol commonly uses both TCP and UDP in different scenarios within the same suite?

Accepted Answer

Introduction / Context: Transport layer selection impacts reliability and overhead. Some application protocols are designed to operate over both TCP and UDP depending on the operation. Knowing which protocol flexibly uses both is essential for firewall rules, troubleshooting, and performance tuning. Given Data / Assumptions: Domain Name System (DNS) resolves names to IP addresses and supports multiple operation types. TCP provides connection-oriented, reliable delivery; UDP is connectionless and lightweight. Other listed protocols (FTP, SMTP, Telnet) are classically TCP-only. Concept / Approach: DNS typically uses UDP port 53 for standard queries and responses because messages are small and frequent. It uses TCP port 53 for zone transfers (AXFR/IXFR) and when responses exceed the UDP size limit or when DNSSEC data necessitates larger payloads. Thus, DNS is the canonical example of a protocol using both transports. Step-by-Step Solution: Identify typical DNS query path: client sends UDP/53 to a resolver; resolver replies via UDP/53.Consider large responses or truncation bit set: client retries using TCP/53.Zone transfers between authoritative servers: use TCP/53 by design. Verification / Alternative check: Packet captures of dig +tcp and zone transfers show TCP/53 connections; standard dig defaults show UDP/53. Documentation for DNS RFCs also specifies both transports. Why Other Options Are Wrong: FTP: control on TCP/21 and data on TCP (active/passive), but not UDP. SMTP: TCP/25 (or 465/587), no UDP operation. Telnet: TCP/23 only. SNMP (extra option) mainly uses UDP/161; TCP is uncommon and not part of basic operations. Common Pitfalls: Blocking UDP/53 at firewalls and breaking resolution; assuming TCP is only for zone transfers—large EDNS0 responses can also switch to TCP. Final Answer: DNS

Question 16

DHCP fundamentals: Which statements correctly describe a DHCP Discover message at Layers 2 and 4?

Accepted Answer

Introduction / Context: Dynamic Host Configuration Protocol (DHCP) automates IP address assignment. Understanding how the initial Discover message is transported helps diagnose why clients fail to obtain addresses across subnets or through security devices. Given Data / Assumptions: Statement 1: Uses FF:FF:FF:FF:FF:FF as the Layer 2 destination (broadcast). Statement 2: Uses UDP as the Transport layer protocol. Statement 3: Uses TCP as the Transport layer protocol. Statement 4: Does not use a Layer 2 destination address. Concept / Approach: Before a host has an IP address, it cannot unicast an IP packet, so DHCP Discover is broadcast. At Layer 2, Ethernet broadcast MAC FF:FF:FF:FF:FF:FF is used. At Layer 4, DHCP rides over UDP: client source port 68 to server destination port 67. Step-by-Step Solution: Evaluate Statement 1: True. Initial Discover is L2 broadcast to FF:FF:FF:FF:FF:FF.Evaluate Statement 2: True. DHCP uses UDP (client 68, server 67).Evaluate Statement 3: False. DHCP never uses TCP.Evaluate Statement 4: False. Ethernet frames always have a destination MAC; the Discover uses the broadcast MAC. Verification / Alternative check: Packet traces (e.g., Wireshark) show BOOTP/DHCP over UDP with Ethernet broadcast for Discover. Relay agents (IP helpers) forward using unicast at Layer 3 while still UDP at Layer 4. Why Other Options Are Wrong: “3 and 4” includes two false statements. “4 only” is incorrect because a destination MAC is required. Single-statement answers omit the correct pairing of 1 and 2. Common Pitfalls: Expecting DHCP to cross routers without a relay; filtering UDP/67-68; confusing ARP broadcasts with DHCP broadcasts. Final Answer: 1 and 2

Question 17

IPv4 addressing classes (legacy concept): Which class of address provides a maximum of 254 usable host addresses per network ID?

Accepted Answer

Introduction / Context: Although modern networks use Classless Inter-Domain Routing (CIDR), legacy classful ranges still appear in exams and historical documentation. Recognizing the host capacity of each class helps map older designs to current subnetting practice. Given Data / Assumptions: Class C default mask: 255.255.255.0 (/24). Usable host count per subnet equals total addresses minus network and broadcast. Class D and E are not used for unicast hosts. Concept / Approach: For a /24 network, there are 2^8 = 256 addresses in the host portion. Subtract 2 for network and broadcast, leaving 254 usable hosts. This aligns with the canonical Class C networks (192.0.0.0–223.255.255.255) under classful rules. Step-by-Step Solution: Compute host space for Class C: 8 host bits.Total addresses = 2^8 = 256.Usable hosts = 256 − 2 = 254. Verification / Alternative check: Contrast with Class A (/8) and Class B (/16) which provide far more host addresses. Class D is multicast, not for hosts; Class E is experimental. Why Other Options Are Wrong: Class A and B yield much larger host counts than 254. Class D is multicast addressing, not host addressing. Class E is reserved/experimental and not used for hosts. Common Pitfalls: Forgetting to subtract network and broadcast; applying classful logic to CIDR blocks where host counts vary by mask. Final Answer: Class C

Question 18

Local network operation: Which protocol is used to discover the hardware (MAC) address that corresponds to a local IPv4 address on the same LAN?

Accepted Answer

Introduction / Context: On Ethernet LANs, devices must map Layer 3 IPv4 addresses to Layer 2 MAC addresses to deliver frames. The protocol that performs this resolution is crucial for basic connectivity and troubleshooting duplicate IPs or stale cache entries. Given Data / Assumptions: We are working with IPv4 on a broadcast LAN (e.g., Ethernet). Hosts require a mapping from IP to MAC before sending unicast frames. The target IP is in the same subnet as the sender. Concept / Approach: Address Resolution Protocol (ARP) broadcasts a query: “Who has IP X? Tell Y.” The owner of IP X responds with its MAC address, allowing Y to populate its ARP table and send frames directly. Reverse ARP (RARP) historically mapped MAC to IP (now superseded by modern boot protocols). ICMP handles control messages, not L2 resolution. Step-by-Step Solution: Sender checks ARP cache for the target IP.If absent, it sends an ARP Request (broadcast MAC FF:FF:FF:FF:FF:FF).Target replies with an ARP Reply containing its MAC; cache is updated. Verification / Alternative check: Use command line tools (arp -a, ip neigh) to inspect cache entries after communication. Packet captures clearly show ARP Request/Reply exchanges preceding unicast traffic. Why Other Options Are Wrong: RARP maps MAC to IP; largely obsolete. IP is the Layer 3 protocol being mapped, not the resolver. ICMP is for control messages (e.g., Echo), not address resolution. DHCP leases addresses; it does not perform per-packet L2 resolution. Common Pitfalls: Assuming ARP works across routers (it does not); ignoring ARP cache timeouts that cause intermittent delays. Final Answer: ARP

Question 19

IPv4 classes (legacy first-octet patterns): What is the first-octet bit pattern that identifies a Class B network address?

Accepted Answer

Introduction / Context: Historically, IPv4 addresses were divided into classes based on the leading bits of the first octet. While CIDR replaced classful routing, the leading-bit patterns still appear on certifications and in legacy documentation. Given Data / Assumptions: Class A addresses start with binary 0. Class B addresses start with binary 10. Class C addresses start with binary 110. The question asks for the Class B pattern in the first octet. Concept / Approach: Interpret “x” as any bit (0 or 1). The first two bits of a Class B address are 10, leaving six bits unspecified in the first octet. Therefore, the generic pattern is 10xxxxxx and corresponds to decimal 128–191 in the first octet. Step-by-Step Solution: Recall classful leading bits: A = 0, B = 10, C = 110.Apply to the first octet of Class B: 10xxxxxx.Confirm decimal range: 128–191 inclusive. Verification / Alternative check: Compare with Class C pattern 110xxxxx (192–223) and Class A 0xxxxxxx (0–127) to ensure no overlap. Why Other Options Are Wrong: 01xxxxxx: not a classful prefix; first bit must be 1 then 0 for Class B. 0xxxxxxx: Class A pattern. 110xxxxx: Class C pattern. 1110xxxx: Class D (multicast) leading bits, not unicast class B. Common Pitfalls: Confusing Class C (110) with B (10); equating decimal boundaries with arbitrary prefixes. Final Answer: 10xxxxxx

TCP/IP Questions