Networks test

What is the Protocol Data Unit (PDU) at Layer 1 of the OSI model?

Bit

Which of the following transmission media belong to the category of guided media?

Twisted pair, coaxial cable, and fiber optic

Why is differential signaling used in Ethernet?

To cancel external electromagnetic interference by subtracting the two opposing signals at the receiver

Which duplex mode is described by the classic walkie-talkie principle?

Half-duplex

What is the main problem with NRZ-L (Non-Return-to-Zero Level) encoding when transmitting long runs of identical bits?

Long runs of the same bit produce no signal transitions, causing the receiver to lose clock synchronization

Which encoding scheme does 100BASE-TX use, and what efficiency does it achieve?

4B/5B with MLT-3, 80% efficiency

How many discrete voltage levels does PAM-5 use, as employed in 1000BASE-T (Gigabit Ethernet)?

5 levels (−2, −1, 0, +1, +2)

What does the abbreviation BASE mean in Ethernet designations such as 10BASE-T?

Baseband transmission — the entire cable carries a single digital signal

A noise-free channel has a bandwidth of 5 MHz and uses PAM-4 (4 signal levels). What is the maximum data rate according to the Nyquist theorem?

20 Mbit/s

What does the Shannon-Hartley theorem describe?

The absolute theoretical upper limit of the data rate on a noisy channel, regardless of the encoding scheme used

What is the maximum supported data rate of Cat5e cables?

1 Gbit/s

What is the maximum reach of Cat6 at 10 Gbit/s, and why is Cat6A superior?

Cat6 only reaches 55 m at 10G; Cat6A achieves

How much power does the PoE standard IEEE 802.3at (PoE+) deliver to the powered device (PD)?

25.5 W

IEEE 802.3bt Type 4 delivers up to 71.3 W. Which cable category is recommended for long PoE runs, and why?

Cat6A or cables with larger conductor cross-sections, to minimize resistive losses over long distances

Why can PoE (Power over Ethernet) not be transmitted over fiber optic cables?

Fiber is an electrical insulator (glass) and cannot conduct electric current

What is the core diameter of single-mode fiber (SMF), and what does this enable?

8–9 µm, allowing only one light mode and enabling distances of 80 km or more

Why must APC connectors (8° angled) never be mated with UPC connectors (flat-polished)?

The angular mismatch creates an air gap that physically damages both ferrules and causes high insertion loss

A new 10 Gbit/s copper run of 80 m is planned (no EMI, limited budget). Which cable category is correct?

Cat6A — supports 10GBASE-T up to

What is the maximum allowed untwist length when terminating Cat6A cables at an RJ45 connector?

Approximately 6 mm

In NRZI (Non-Return-to-Zero Inverted) encoding, how is a binary 1 represented on the wire?

A transition (level change) occurs at the start of the bit period

What signaling scheme does 100BASE-TX place on the wire after 4B/5B block coding?

MLT-3 (Multi-Level Transmit, three levels)

Why does 4B/5B coding map 4 data bits onto 5-bit code words?

The redundant codes guarantee enough transitions (no more than three consecutive zeros) for clock recovery

What is the main purpose of scrambling a bit stream before transmission?

To randomize the data so long runs of identical bits are broken up, aiding clock recovery and reducing spectral peaks

Differential Manchester encoding signals a binary 0 by

a transition at the start of the bit period (the mandatory mid-bit transition is always present)

Why does MLT-3 reduce the dominant signal frequency compared to binary NRZI at the same bit rate?

It takes four bit periods to complete one full waveform cycle, so the fundamental frequency is about one quarter of the bit rate

Which Ethernet standard uses Manchester encoding on the wire?

10BASE-T

A channel has a bandwidth of 4 kHz and uses 4 signal levels. What is the Nyquist capacity? C = 2 · B · log2(L).

16,000 bit/s

Using the Nyquist formula C = 2 · B · log2(L), how many signal levels are required to reach 24 kbit/s over a 3 kHz channel?

16 levels

A channel has B = 1 MHz and a linear SNR of 3. What is the approximate Shannon capacity? C = B · log2(1 + SNR).

2 Mbit/s

A 10 MHz channel has an SNR of 20 dB. What is the approximate Shannon capacity? (20 dB = linear 100.)

About 66.6 Mbit/s

Bandwidth and data rate are related but distinct. Which statement is correct?

Bandwidth is a frequency range in Hz; for a fixed bandwidth the data rate rises by using more signal levels or higher SNR

A −10 dB change in power corresponds to which multiplier?

× 0.1 (one tenth)

What does 0 dBm represent in absolute terms?

1 milliwatt

Differential signaling cancels external noise because

the same interference is induced on both wires and the receiver outputs the difference (A − B), removing the common component

Which duplex mode transmits in one direction only, such as a broadcast TV signal?

Simplex

Cat6 cable is specified to what frequency bandwidth?

250 MHz

Cat8 cable is specified to which bandwidth, and what is its maximum reach?

2,000 MHz, with a maximum reach of about 30 m

A standard twisted-pair data cable contains how many pairs, and why are the pairs twisted at different rates?

Four pairs; different twist rates reduce crosstalk between the pairs

Why must shielded cabling be properly grounded at the appropriate point(s)?

Improper grounding can let the shield act as an antenna and worsen performance instead of improving it

FEXT (Far-End Crosstalk) is distinguished from NEXT by

being measured at the far end of the link, where the disturbing signal has also attenuated

Why is alien crosstalk the key barrier that Cat6A addresses for 10GBASE-T over 100 m?

Because 10 Gbit/s uses all pairs in both directions, and AXT from neighboring cables cannot be cancelled by the receiver; Cat6A's design and shielding suppress it

What limits the distance and bandwidth of multimode fiber compared to single-mode?

Modal dispersion, as different light paths (modes) arrive at slightly different times

Which fiber wavelength is associated with the C-band used for long-haul single-mode transmission and lowest attenuation?

1550 nm

The ST fiber connector is characterized by which coupling mechanism?

A bayonet twist-lock

By color code, an APC connector body is typically which color, and UPC which color?

APC is green; UPC is blue

IEEE 802.3bt Type 4 (PoE++) delivers what power at the PSE, and what is available at the powered device?

Up to 90 W at the PSE, with about 71.3 W available at the PD

What does the "BASE" in standards like 100BASE-TX and 1000BASE-T denote?

Baseband signaling, where the medium carries a single digital signal occupying the full bandwidth

How many pairs does 1000BASE-T use, and in what manner?

All 4 pairs, each carrying data bidirectionally and simultaneously with echo cancellation

What is the baud (symbol) rate of 100BASE-TX on the wire?

125 MBd

Which Ethernet copper standard requires Cat6A to reliably reach 100 m?

10GBASE-T

What is the chief disadvantage of Manchester encoding that motivated its replacement at 100 Mbit/s?

It needs twice the bandwidth of the bit rate (only 50 percent efficient)

Which statement about clock recovery and line coding is correct?

A good line code guarantees frequent transitions so the receiver can continuously recover and lock its clock to the data

What is the Protocol Data Unit (PDU) at Layer 2 of the OSI model?

Frame

What is the main function of the LLC sublayer (Logical Link Control, IEEE 802.2)?

Protocol multiplexing: identifying the Layer 3 protocol (IP, ARP, IPv6) carried in the frame

What do the first 3 bytes (24 bits) of a MAC address encode?

The OUI (Organizationally Unique Identifier) — the manufacturer identifier assigned by the IEEE

What does I/G bit = 1 in the first byte of a MAC address indicate?

The address is a multicast or broadcast address (group address)

Which MAC address is the universal broadcast address, and which protocols typically use it?

FF: FF: FF: FF: FF: FF — used by ARP requests and DHCP Discover, among others

An Ethernet frame contains EtherType 0x0806. Which Layer 3 protocol is in the payload?

ARP (Address Resolution Protocol)

Why is the minimum Ethernet frame size 64 bytes?

Due to the legacy CSMA/CD mechanism: a frame had to be long enough so that it was still being transmitted when the collision signal returned from the far end of the cable

What does the MTU (Maximum Transmission Unit) define in standard Ethernet, and how does it differ from the total frame size?

The MTU is 1500 bytes (payload only); the total frame size is up to 1518 bytes (Preamble/SFD are outside the counted frame)

What can CRC-32 (Frame Check Sequence) do, and what can it NOT do?

CRC-32 can detect errors but NOT correct them; corrupted frames are silently discarded, and correction is handled by higher-layer protocols such as TCP

What is the function of the preamble (7 bytes) in an Ethernet frame?

It is an alternating 1-0 pattern that allows the receiver to synchronize its clock to the incoming signal frequency before the actual data arrives

What is the fundamental difference between a hub (Layer 1) and a switch (Layer 2) regarding collision domains?

A hub forms one large shared collision domain for all ports; a switch creates a separate collision domain per port (full-duplex, no collisions)

What does a switch do when it receives a frame destined for a MAC address that is not in its CAM table?

It floods the frame to all ports except the ingress port (unknown unicast flooding)

Why can devices in different VLANs not communicate directly at Layer 2?

VLANs create separate broadcast domains; a Layer 3 device (router or L3 switch) is required for inter-VLAN communication

Which EtherType value does an 802.1Q VLAN tag use in an Ethernet frame?

0x8100

How long does convergence take in classic STP (802.1D), and what is the operational consequence?

Approximately 30–50 seconds; this represents a significant outage during topology changes

Host A (192.168.1.10) wants to send a frame to Host B (192.168.1.20) but does not know its MAC address. Which ARP sequence is correct?

Host A broadcasts an ARP Request to FF: FF: FF: FF: FF: FF; only Host B replies with a unicast ARP Reply containing its MAC address; Host A caches the mapping in its ARP table

What is a Gratuitous ARP, and for which legitimate purposes is it used?

An unsolicited ARP Reply in which a device announces its own IP-to-MAC mapping; used at boot time, during failover, and to detect IP address conflicts

Which of the four core functions of the Data Link Layer is responsible for organizing a raw stream of bits into structured units before transmission?

Framing

How many total bits and bytes make up a standard MAC address?

48 bits (6 bytes)

When the I/G bit (bit 0 of the first byte) of a MAC address is 0, the address is:

A unicast address (a single, individual device)

The Logical Link Control (LLC) sublayer is defined by which IEEE standard?

IEEE 802.2

In an Ethernet II frame, how large is the EtherType field?

2 bytes

What is the valid payload size range of a standard Ethernet II frame?

46 to 1500 bytes

An end station receives an Ethernet frame with EtherType 0x0800. Which protocol does the payload contain?

IPv4

How large is the Preamble in an Ethernet frame, and what is its purpose?

7 bytes of alternating 1-0 pattern used for receiver clock synchronization

What is the standard Ethernet MTU, and what does it count?

1500 bytes, counting the payload only

A station needs to send a payload of only 20 bytes. What happens to satisfy the minimum frame size?

The payload is padded up to 46 bytes so the total frame reaches 64 bytes

Which of the following is NOT something CRC-32 can detect?

It cannot correct any errors it finds

What is the typical default aging timer for entries in a switch CAM table?

300 seconds (5 minutes)

In a CAM table overflow attack, the attacker floods the switch with many random source MAC addresses. What is the result?

The CAM table fills up and the switch falls back to flooding all frames, allowing the attacker to sniff traffic

At which OSI layer does a hub operate, and how does it handle an incoming frame?

Layer 1; it repeats the signal out of all other ports regardless of destination

A bridge and a switch are functionally related. Which statement best describes their relationship?

A switch is essentially a multiport bridge implemented in hardware; both operate at Layer 2 and learn MAC addresses

The 64-byte minimum Ethernet frame size is fundamentally tied to which mechanism?

CSMA/CD collision detection — the frame must still be transmitting when a collision signal could return from the far end

In an 802.1Q tag, what is the value of the TPID field that identifies the frame as VLAN-tagged?

0x8100

What is the function of the 3-bit PCP (Priority Code Point) field in an 802.1Q tag?

It carries a Class of Service (CoS) priority value from 0 to 7 for QoS

On a trunk port, frames belonging to the native VLAN are transmitted in what manner?

Untagged

Two PCs are connected to the same switch but are in VLAN 10 and VLAN 20 respectively. To communicate, what is required?

A Layer 3 device (router or L3 switch) with an interface in each VLAN

Classic STP is defined by which IEEE standard?

IEEE 802.1D

How does STP elect the root bridge?

The switch with the lowest Bridge ID becomes the root bridge

Which destination MAC address is used for STP BPDU (Bridge Protocol Data Unit) frames?

01:80: C2:00:00:00

What is the role of an STP root port on a non-root switch?

It is the port with the lowest path cost toward the root bridge

In which STP port state does a port populate the MAC address table but still not forward user frames?

Learning

Which standard STP path cost corresponds to a 100 Mbps link?

19

How does the target host send its ARP Reply?

As a unicast directly back to the requesting host

What is the typical default timeout for entries in a host's ARP cache?

300 seconds

A user on an access port in VLAN 10 cannot reach a server on the same switch. show vlan brief reveals the server's port is in VLAN 20. What is the cause?

A VLAN mismatch — the two devices are in different broadcast domains and need Layer 3 routing

Two directly connected switch ports show many late collisions and CRC errors, and throughput is poor. show interfaces status hints at a configuration issue. What is the most likely cause?

A duplex mismatch (one side half-duplex, the other full-duplex)

Cut-through switching achieves very low latency because it:

Begins forwarding as soon as the destination MAC is read, without waiting for the full frame or CRC check

Which Layer 2 attack is mitigated by Dynamic ARP Inspection (DAI)?

ARP spoofing (ARP cache poisoning)

Wireshark display filter eth. type == 0x0806 would capture which traffic?

ARP frames only

Link Aggregation (IEEE 802.3ad / LACP) combines multiple physical links. How does it typically distribute traffic?

By hashing fields such as source/destination MAC or IP to select a member link (per-flow)

The destination MAC FF: FF: FF: FF: FF: FF in a frame tells a switch to:

Flood the frame to all ports except the ingress port

An IPv4 address is structured as 32 bits. How are these bits grouped in dotted-decimal notation?

Four octets of 8 bits each, separated by dots

What is the decimal value of the binary octet 00010000?

16

Which 8-bit binary value represents the decimal number 172?

10101100

How many total IPv4 addresses are theoretically possible with 32 bits?

4,294,967,296 (2^32)

Which IPv4 address class is reserved for multicast?

Class D (224

Which CIDR prefix corresponds to the RFC 1918 private range 172.16.0.0?

/12

What is the full address range covered by the loopback block 127.0.0.0/8?

127.0.0.0

The address block 169.254.0.0/16 is used for which purpose?

Link-Local / APIPA addresses self-assigned when DHCP fails

How many usable host addresses does a /29 subnet provide?

6

How many /28 subnets can be created from a single /24 network?

16

What is the dotted-decimal subnet mask for a /20 prefix?

255.255.240.0

What is the network address of host 10.10.10.130 with a /25 mask?

10.10.10.128

For the subnet 192.168.1.64/26, what are the first and last usable host addresses?

First: 192.168.1.65, Last: 192.168.1.126

Using a /27 mask, what is the block size (number of addresses per subnet)?

32

A point-to-point WAN link needs only 2 usable addresses. Which prefix is the classic choice?

/30

In a VLSM design, after allocating Engineering 10.0.0.0/25 (126 hosts), at which address does the next subnet start?

10.0.0.128

The IHL (Internet Header Length) field holds its minimum value of 5. How many bytes of header does this represent?

20 bytes (5 × 4-byte words)

What is the purpose of the Identification field in the IPv4 header?

It carries the same value for all fragments of one original packet so the destination can group them for reassembly

Which protocol number appears in the IPv4 Protocol field for UDP?

17

The MF (More Fragments) flag is set to 0. What does this indicate?

This is the last fragment (or the packet was not fragmented)

What is the principle behind Path MTU Discovery using the DF flag?

Send packets with DF set; if a router cannot forward without fragmenting it returns an ICMP "fragmentation needed" message, so the sender lowers packet size

What is the correct name for the PDU (Protocol Data Unit) at Layer 3 of the OSI model?

Packet

Why are both MAC addresses (Layer 2) and IP addresses (Layer 3) necessary?

MAC addresses are flat and non-hierarchical (routing is not possible); IP addresses are hierarchical and enable routing.

How many bits does an IPv4 address consist of, and how many possible addresses does that theoretically yield?

32 bits, approximately 4.3 billion addresses (2^32)

What is the decimal value of the binary number 10101100?

172

A host has the IP address 192.168.1.100 with a /24 subnet mask. What is the network portion and what is the host portion?

Network: 192.168.1, Host:

What is the purpose of the 169.254.x. x (APIPA / Link-Local) address range?

It is automatically assigned when a device cannot reach a DHCP server.

Which organization manages IP address allocation in Europe (including Austria)?

RIPE NCC

What was the main advantage of introducing CIDR in 1993 over classful addressing?

CIDR allows flexible prefix lengths (e.g., /22) instead of being restricted to fixed Class A, B, or C sizes, dramatically reducing address waste.

Why are 2 addresses always subtracted from the total number of addresses in a subnet when calculating usable hosts?

Because the network address (all host bits = 0) and the broadcast address (all host bits = 1) cannot be assigned to any device.

What is the broadcast address of the subnet 192.168.1.64/26?

192.168.1.127

What is VLSM (Variable Length Subnet Masking) and why is it used in practice?

VLSM allows different prefix lengths within the same address space, so subnets can be sized precisely for their actual needs (e.g., /25 for

A company needs a subnet for exactly 500 hosts. What is the smallest prefix that meets this requirement?

/23 (510 usable hosts)

How large is an IPv4 header without options, and what is the minimum value of the IHL field?

20 bytes; minimum IHL value = 5 (5 × 4 bytes = 20 bytes)

Where does the reassembly of fragmented IPv4 packets take place?

Exclusively at the destination host — never at intermediate routers.

What is the function of the default gateway for a host?

It is the IP address of the router interface on the local subnet; the host forwards all packets destined for other networks to this address.

A routing table contains the entries 10.0.0.0/8, 10.50.0.0/16, and 0.0.0.0/0. A packet arrives destined for 10.50.5.1. Which route is used?

10.50.0.0/16, because /16 is the longest matching prefix.

What happens at Layer 2 when a router receives a packet on interface eth0 and forwards it out interface eth1?

The router strips the old Layer 2 header (with the incoming MAC addresses), creates a new Layer 2 header with the appropriate MAC addresses for the next link, and decrements the TTL.

A user reports no internet connectivity. Running ipconfig / ip addr shows the IP address 169.254.15.23. What is the most likely cause?

The device failed to reach a DHCP server and automatically assigned itself an APIPA address (169.254.x.x).

How many bits does an IPv6 address use?

128

In which year was the global IANA IPv4 address pool fully depleted?

2011

How many addresses does the IPv6 address space provide (approximately)?

3.4 × 10^38

What is the standard subnet prefix length for an IPv6 subnet?

/64

IPv6 has no broadcast. What mechanism replaces broadcast functionality?

Multicast

Which IPv6 address type is automatically generated on every interface, never routed beyond the local link, and starts with fe80:?

Link-Local

What is the prefix for IPv6 Global Unicast Addresses (GUA)?

2000:/3

What is the IPv6 loopback address?

:1

The IPv6 header has a fixed size of how many bytes?

40

How many fields does the IPv6 header contain?

8

IPv6 does not include a header checksum.

True

In IPv6, routers can fragment packets if they are too large for a link.

False

The IPv6 "Hop Limit" field serves the same purpose as the IPv4 TTL field.

True

Expand the abbreviated IPv6 address 2001: db8:1 to its full form. Which is correct?

2001:0db8:0000:0000:0000:0000:0000:0001

Why may the: (double colon) appear only once in an IPv6 address?

Using it twice would make the number of replaced zero groups ambiguous

The IPv6 default route covering all destinations is expressed as:

:/0

In practice, which sub-range of the ULA block is actually used because the L bit is set to 1 for locally assigned prefixes?

fd00:/8

Which prefix identifies all IPv6 multicast addresses?

ff00:/8

The solicited-node multicast address used by Neighbor Discovery is formed from which prefix?

ff02:1: ff00:0/104

A GUA (Global Unicast) address typically divides into which three parts?

Global routing prefix, subnet ID, interface ID

Within a /48 site allocation, how many bits remain for the subnet ID before the /64 interface boundary?

16

When pinging a link-local address such as fe80:1, why must the interface (zone ID) be specified, e.g. fe80:1%eth0?

Link-local addresses are not unique across interfaces, so the host must know which link to use

Which of these addresses is a link-local address?

fe80: a1: b2ff: fe03: c4d5

Roughly how many addresses does the 128-bit IPv6 space contain?

About 3.4 × 10^38

Which IPv6 header field is used for QoS / DSCP marking, analogous to the IPv4 Type of Service?

Traffic Class

Which IPv6 header field identifies the type of the next header (upper-layer protocol or extension header)?

Next Header

In the IPv6 Next Header field, which value indicates that UDP follows?

17

Optional IPv6 functionality (fragmentation, source routing, IPsec) is carried in what?

Extension headers chained via the Next Header field

Which Next Header value identifies the Fragment extension header?

44

Because IPv6 routers never fragment, what must the source use to avoid oversized packets?

Path MTU Discovery

Which RFC defines stateless address autoconfiguration (SLAAC)?

RFC 4862

During Duplicate Address Detection, what message does the host send and to which destination?

A Neighbor Solicitation to the solicited-node multicast address

After inserting FFFE, the EUI-64 process flips which bit of the first byte?

The 7th bit (the U/L, universal/local bit)

What privacy problem do Privacy Extensions (RFC 4941) solve?

EUI-64 embeds the MAC address, allowing devices to be tracked across networks

In stateless DHCPv6 (RA flags A=1, O=1), how is the address obtained versus the extra configuration?

The address comes from SLAAC; DHCPv6 supplies extra info such as DNS servers

On which UDP port does a DHCPv6 client listen?

546

Which RFC defines the Neighbor Discovery Protocol (NDP)?

RFC 4861

Which ICMPv6 type number is assigned to the Neighbor Solicitation message?

135

Which NDP message lets a router inform a host of a better next-hop for a destination?

Redirect

What does NAT64 accomplish?

It translates between IPv6 and IPv4 so IPv6-only clients can reach IPv4 servers

Which compressed address is INVALID because it uses: more than once?

2001: db8:1

Which everyday IPv6 functions rely on link-local addresses?

NDP, SLAAC router solicitation/advertisement, and routing-protocol adjacencies

IPv6 routers along the path are allowed to fragment packets that exceed the link MTU.

False

DHCPv6 servers listen on UDP port 546 while clients use 547.

False

IPv6 still includes a header checksum that routers recalculate at each hop.

False

The IPv6 loopback address: 1 is 64 bits long.

False

Neighbor Solicitation messages are sent to the solicited-node multicast address during address resolution and DAD.

True

When abbreviating an IPv6 address, the rule is that: (double colon) can be used to replace the longest consecutive run of all-zero groups. How many times can: appear in a single address?

Once

In SLAAC, a host sends a Router Solicitation to which IPv6 multicast address?

ff02:2 (all routers)

DHCPv6 uses which UDP ports?

546 and

Privacy Extensions (RFC 4941) generate a random Interface ID to prevent

tracking of users across networks via their MAC-derived address

What is the difference between forwarding (data plane) and routing (control plane)?

Forwarding moves individual packets based on the routing table; routing builds and maintains the routing table using protocols

A routing table contains entries for 10.0.0.0/8, 10.1.0.0/16, and 10.1.1.0/24. A packet is destined for 10.1.1.50. Which entry will the router use?

10.1.1.0/24 (most specific match)

To enable IPv4 forwarding on a Linux system, which file must contain the value 1?

/proc/sys/net/ipv4/ip_forward

Static routes added with "ip route add" on Linux are lost after a reboot.

True

What is an Autonomous System (AS)?

A network or group of networks under one administrative authority with a unified routing policy

Which algorithm does OSPF use to calculate the shortest path?

Dijkstra SPF (Shortest Path First)

Which routing protocol uses the DUAL algorithm and supports unequal-cost load balancing?

EIGRP

BGP prevents routing loops by using the

AS-PATH attribute (a route that already contains the local AS is rejected)

PAT (Port Address Translation) allows many private IP addresses to share a single public IP address. What field is used to distinguish the individual connections?

Source port number

CGNAT (Carrier-Grade NAT) uses which reserved address range?

100.64.0.0/10

In a firewall rule set, the principle that "what is not explicitly permitted is denied" is called:

Implicit deny

Which plane of operation is responsible for moving an individual packet from an input interface to an output interface?

The data plane (forwarding)

A Linux route shows "proto kernel scope link src 192.168.1.10". What kind of route is this?

A directly connected route, auto-created when the IP address was assigned to the interface

A routing table has 192.168.0.0/16 and 192.168.4.0/24. A packet for 192.168.9.7 arrives. Which entry is used?

192.168.0.0/16, because 192.168.9.7 does not fall inside 192.168.4.0/24

Which is a genuine disadvantage of static routing?

It does not scale and provides no automatic failover when topology changes

By default, a Linux machine with two NICs in different subnets will NOT route packets between them because

IP forwarding is disabled by default and the packet is silently dropped

A router is a Layer 3 device that

connects different subnets and forwards packets between them based on IP addresses

Which categorisation is correct?

OSPF and IS-IS are link-state IGPs; RIP and EIGRP are distance-vector IGPs; BGP is a path-vector EGP

Which RIP loop-prevention technique stops a router from advertising a route back out the interface on which it was learned?

Split horizon

Which transport protocol and port does RIP use to exchange updates?

UDP port

How does OSPF differ from RIP regarding update behaviour?

OSPF sends updates only when the topology changes, not periodically like RIP

An OSPF Area Border Router (ABR)

connects one or more non-backbone areas to the backbone Area 0

Which protocol uses a composite metric based primarily on bandwidth and delay and guarantees loop-free paths with DUAL?

EIGRP

Which statement about BGP route selection is most accurate?

BGP selects routes based on policy and business relationships, not strictly the shortest path

What is the Administrative Distance of iBGP?

200

Two routing sources advertise the same network: OSPF (AD 110) and EIGRP internal (AD 90). Which route is installed in the routing table?

The EIGRP route, because a lower Administrative Distance is more trusted

Which statement about Static NAT is correct?

It provides a permanent one-to-one mapping between a private and a public IP, allowing inbound access (e.g., to a server)

Approximately how many simultaneous sessions can a single public IP support under PAT, limited by the source-port field?

Around 65,000 (limited by the 16-bit port range)

A major drawback of NAT for certain applications is that it

breaks true end-to-end connectivity, complicating protocols like FTP, SIP/VoIP, and IPsec AH

What is a key consequence of an ISP deploying CGNAT?

It adds a second layer of NAT, so customers share public IPs and inbound connections become harder

Which conntrack state describes the very first packet of a new connection?

NEW

The default-deny (implicit deny) principle means

anything not explicitly permitted by a rule is dropped

In iptables, packets generated by the local host itself traverse which chain?

OUTPUT

Which Linux firewalling framework is the modern successor to iptables, unifying IPv4, IPv6, ARP, and bridge filtering?

nftables

Traceroute reveals the path a packet takes by

sending packets with incrementing TTL values and collecting the ICMP Time Exceeded replies from each hop

In a TCP segment, what does the Acknowledgment Number field actually contain?

The sequence number of the NEXT byte the receiver expects to receive

What is the semantic difference between the PSH and URG flags in TCP?

PSH tells the receiver to deliver buffered data to the application immediately; URG marks a region of the stream (via the Urgent Pointer) as priority out-of-band data

What is the purpose of TCP keepalive probes?

To detect dead peers and keep idle-connection state alive by periodically probing a connection that has had no data for a long time

What problem does Karn's algorithm solve in TCP's RTT estimation?

It excludes RTT samples from retransmitted segments, removing the ambiguity of not knowing whether an ACK matches the original or the retransmission

Why is QUIC 0-RTT data considered vulnerable to replay attacks?

The early data is sent before the full handshake completes using a pre-shared key, so an attacker can capture and resend it; therefore only idempotent requests should be sent as 0-RTT

How many bits is a port number?

16 bits

What is the port range for well-known (system) ports?

0 to 1023

What is the port range for dynamic/ephemeral ports?

49152 to 65535

How many values are used to uniquely identify a TCP connection (the so-called 4-tuple)?

Source IP + source port + destination IP + destination port (4 values)

A web server can handle thousands of simultaneous TCP connections to the same port 443 because:

Each connection has a unique 4-tuple (different source IP and/or source port)

Which "ss" command shows all listening TCP and UDP ports with their owning process?

ss -tulnp

Which well-known port does SSH use?

22

Which well-known port does HTTPS use?

443

Which well-known ports does FTP use for control and data?

21 (control) and 20 (data)

Which well-known port does SMTP Submission (authenticated mail submission) use?

587

Which well-known port does POP3 (unencrypted) use?

110

Which well-known port does IMAP (unencrypted) use?

143

Which well-known port and protocol does DNS primarily use for queries?

53 (UDP and TCP)

Which well-known port does NTP (Network Time Protocol) use?

123 (UDP)

Which well-known port does SNMP Trap use to receive notifications?

162 (UDP)

Which well-known port does LDAP use?

389

Which well-known port does SMB (Windows file sharing) use?

445

Which registered port does PostgreSQL use?

5432

DNS uses TCP instead of UDP in which situation(s)?

Zone transfers and responses larger than

What is the minimum size of a TCP header?

20 bytes

Which IP protocol number is assigned to TCP?

6

Why does TCP use a 3-Way Handshake instead of a 2-Way Handshake?

Both sides need to synchronise independent Initial Sequence Numbers and confirm bidirectional reachability

Why is the Initial Sequence Number (ISN) chosen pseudo-randomly?

To prevent TCP sequence prediction attacks (RFC 6528)

How long does the TIME_WAIT state typically last?

2 × MSL (approximately

Which TCP flag is used to abruptly terminate a connection (no graceful teardown)?

RST

How does TCP detect packet loss using duplicate ACKs (Fast Retransmit)?

After receiving 3 duplicate ACKs (4 ACKs with the same number), retransmit the missing segment immediately

A TCP connection in ESTABLISHED state means:

The 3-Way Handshake is complete and data can flow in both directions

Many connections in SYN_RECEIVED state on a server most likely indicate:

A potential SYN flood attack

What is the size of the UDP header?

8 bytes (fixed)

How many fields does the UDP header contain?

4 (source port, destination port, length, checksum)

Which of the following is NOT a typical reason to choose UDP over TCP?

Guaranteed in-order delivery

Which statement about TCP and broadcast/multicast is correct?

TCP cannot perform broadcast or multicast — it is strictly point-to-point

What does Flow Control protect against, and what mechanism is used?

Protects the receiver from buffer overflow; uses the Receiver Window (rwnd)

During TCP Slow Start, how does the congestion window (cwnd) grow?

Exponentially — it doubles every RTT (starting from 1 MSS)

When TCP detects loss via RTO timeout (no ACKs at all), how does it react?

Resets cwnd to 1 MSS and restarts Slow Start

ECN (Explicit Congestion Notification) allows congestion to be signalled:

By routers marking IP packets instead of dropping them

Which transport protocol does HTTP/3 use?

QUIC over UDP

A "connection refused" error when connecting to a TCP service usually means:

No process is listening on the requested port (the server sent RST)

Which sysctl tweak helps when a server runs out of ephemeral source ports?

Extending the ephemeral port range via net. ipv4. ip_local_port_range

Which HTTP status code is returned when a new resource has been successfully created, for example after a successful POST?

201 Created

What is the key difference between a 307 Temporary Redirect and a classic 302 Found?

307 guarantees the HTTP method (e.g. POST) is preserved on the redirected request, whereas

Which status code tells the client that the resource was deliberately and permanently removed, and will not return (stronger than 404)?

410 Gone

A server is temporarily overloaded or down for maintenance and cannot handle the request right now. Which status code is correct?

503 Service Unavailable

A response includes the header "ETag: "v17-cd23"". On a later request, which header does the client send to ask the server whether the cached copy is still valid?

If-None-Match

What does "Transfer-Encoding: chunked" allow a server to do?

Send the response body in pieces without knowing the total length in advance, omitting Content-Length

What is the primary purpose of the HTTP OPTIONS method?

To discover the communication options (e.g. allowed methods) available for a resource, also used in CORS preflight

During TLS negotiation, which extension lets the client and server agree on the application protocol (e.g. h2 for HTTP/2) within the handshake?

ALPN (Application-Layer Protocol Negotiation)

An SRV record encodes which information for locating a service?

Priority, weight, port and target hostname for a named service

What is "negative caching" in DNS?

Caching the fact that a name does NOT exist (an NXDOMAIN response) for a period defined by the SOA, to avoid repeated failing lookups

Which of the following is NOT a Layer 7 protocol?

TCP

When you type "amazon. de" and press Enter, which step happens FIRST?

DNS resolves the name to an IP address

HTTP is fundamentally based on which communication pattern?

Request and response

In an HTTP request, which line comes first?

The request line (method + path + version)

Which HTTP header tells the server which website the request is for, when multiple sites share one IP?

Host

Which HTTP method is used to READ a resource without modifying it?

GET

Which HTTP method is NEITHER safe NOR idempotent?

POST

An HTTP status code starting with 2xx indicates:

Success

An HTTP status code starting with 4xx indicates:

The client made a mistake

Which status code means "the resource has not been modified, use your cached copy"?

304 Not Modified

What is the precise meaning of HTTP status code 403?

Authenticated, but you are not authorised to access this resource

Which status code is typically returned by a reverse proxy when it cannot reach the backend?

502 Bad Gateway

What is the main performance limitation of HTTP/1.1 that browsers worked around by opening 6 to 8 parallel TCP connections?

Only one request can be in flight per TCP connection at a time

Which feature of QUIC lets an HTTP/3 session survive a Wi-Fi to cellular network switch?

Connection migration (via connection IDs instead of the 4-tuple)

HTTPS is best described as:

HTTP wrapped in a TLS encryption layer

What is the primary purpose of HTTP cookies?

To give HTTP state — for example, to remember that a user is logged in

Which architectural model does nginx primarily use, that makes it efficient for handling many idle connections?

Event-driven with a small number of worker processes

Which API style is the default choice for public APIs and uses JSON over HTTP?

REST

What is the primary function of DNS?

Translate human-readable domain names into IP addresses (and vice versa)

Which symbol represents the DNS root zone?

A single dot (.)

When your browser needs to resolve a domain name, which server does it talk to directly?

Its configured resolver (often the ISP or a public resolver like 1.1.1.1)

Which DNS record type maps a name to an IPv4 address?

A

Which DNS record type defines an alias from one name to another name?

CNAME

Which DNS record type lists the authoritative nameservers for a domain?

NS

Which DNS record type controls which Certificate Authorities are allowed to issue TLS certificates for a domain?

CAA

What does DNSSEC protect against?

Tampering and cache poisoning of DNS answers (integrity)

What is one practical advantage of DoH over DoT?

DoH traffic looks identical to normal HTTPS, making it much harder to block or distinguish on the network

What is the primary defence against DNS cache poisoning attacks?

DNSSEC, combined with randomised source ports and transaction IDs

A standard MTA from 1985 receives a modern MIME message with base64 attachments it cannot interpret. What does it do?

It relays the message unchanged, because MIME lives entirely inside the body and is invisible to SMTP

Why is the LMTP / local pipe used by the MDA (typically port 24) distinct from SMTP relay on port 25?

LMTP delivers to the final mailbox store and returns a separate status per recipient instead of queuing

Which SMTP reply code is returned by QUIT when the server closes the session politely?

221

What is the difference between reply codes 450 and 550 for an unavailable mailbox?

450 is a transient failure (retry later);

The SMTP VRFY command is usually disabled on public servers. Why?

It lets an attacker confirm which addresses exist, leaking valid recipients for spam or attacks

What is the advantage of BDAT (CHUNKING, RFC 3030) over the classic DATA command?

BDAT sends a declared byte count so no dot-stuffing or end-of-data scanning is needed

A receiving MTA does not advertise SMTPUTF8 but a sender tries to use an internationalised (UTF-8) address. What is the correct rejection?

550 5.6.7 Need SMTPUTF8 support

A DSN message is structured using which MIME content type defined by RFC 3464?

multipart/report

What is the primary purpose of the Message-ID: header?

A globally unique, domain-scoped identifier used for threading (In-Reply-To/References) and loop/duplicate detection

Which MIME multipart subtype glues independent parts such as a text body plus separate file attachments?

multipart/mixed

Quoted-printable encoding represents the byte 0xE2 (part of a UTF-8 sequence) on the wire as

#NAZWA?

The internationalised domain münchen. de is stored on the wire (without SMTPUTF8) as which Punycode form?

xn--mnchen-3ya. de

In a DKIM-Signature header, what does the bh= tag contain?

The hash of the canonicalised message body

In a DKIM-Signature, "c=relaxed/relaxed" specifies

the canonicalisation algorithms applied to the header and body before hashing

In a DMARC record, what does the pct= tag control?

The percentage of mail to which the published policy is applied (useful during rollout)

What problem does ARC (Authenticated Received Chain, RFC 8617) solve?

It preserves original SPF/DKIM/DMARC results across forwarders so legitimate forwarded mail is not failed

Which acronym describes the email client a user actually interacts with (Outlook, Thunderbird, Apple Mail)?

MUA — Mail User Agent

Which agent relays mail between domains using DNS MX lookups?

MTA — Mail Transfer Agent

What does it mean that email is "store-and-forward"?

Each MTA accepts the whole message into a queue and only then attempts the next hop

Which addresses constitute the SMTP "envelope" of an email?

MAIL FROM and RCPT TO

Which Content-Transfer-Encoding is best suited for arbitrary binary attachments like PDFs and images?

base64

Which SMTP port is reserved for MTA-to-MTA relay between domains?

25

Which SMTP port provides implicit TLS (encrypted from byte 1) for client submission, re-blessed by RFC 8314?

465

SMTP is best characterised as which kind of protocol?

Stateful, plain-text, line-oriented, command/response over a single TCP connection

An SMTP reply code starting with 5xx means:

Permanent negative — stop, do not retry

Which SMTP command requests the extended capability list (ESMTP)?

EHLO

How does the DATA portion of an SMTP message end?

A line containing only a single dot (CRLF. CRLF)

Which SMTP AUTH mechanism is considered modern and resistant to replay attacks?

SCRAM-SHA-256

When picking among multiple MX records for a domain, which one does the sender try first?

The MX record with the lowest preference number

Which port is used for POP3 with implicit TLS (POP3S)?

995

Why is POP3 mostly considered legacy in 2026?

It cannot natively synchronise folders, flags or read-state across multiple devices

Which port is used for IMAP with implicit TLS (IMAPS)?

993

What is the difference between FETCH BODY[TEXT] and FETCH BODY. PEEK[TEXT]?

BODY[TEXT] implicitly sets the Seen flag; BODY. PEEK[TEXT] retrieves the content without changing any flag

How does a STRIPTLS downgrade attack work against mail submission?

An on-path attacker silently removes the STARTTLS line from the server's EHLO reply, causing the client to fall back to plaintext

What does SPF (RFC 7208) publish?

A list of IP addresses authorised to send mail for a domain (as a DNS TXT record)

Which DMARC policy value tells receivers to monitor only and apply no enforcement?

p=none

Which mechanism preserves SPF, DKIM and DMARC results across mailing-list forwarders that would otherwise break them?

[moodle]ARC — Authenticated Received Chain (RFC 8617)

How many layers does the OSI reference model define?

7

Which OSI layer is closest to the end user?

Layer 7 (Application)

What is the Protocol Data Unit (PDU) at the OSI Transport layer?

Segment

What is the Protocol Data Unit (PDU) at the OSI Data Link layer?

Frame

Which is the correct order of the OSI layers from Layer 1 to Layer 7?

Physical, Data Link, Network, Transport, Session, Presentation, Application

Which OSI layer provides end-to-end data delivery, reliability, and flow control?

Transport layer (Layer 4)

Which OSI layer transmits raw bits over a physical medium?

Physical layer (Layer 1)

Which OSI layer handles data format translation, encryption, and compression?

Presentation layer (Layer 6)

Character encoding such as ASCII and Unicode is a task of which OSI layer?

Presentation layer (Layer 6)

Data compression to reduce the size of transmitted data is performed at which OSI layer?

Presentation layer (Layer 6)

Dialog control and the management of full-duplex, half-duplex, and simplex communication modes is a function of which OSI layer?

Session layer (Layer 5)

Which of the following are listed as examples of Session layer mechanisms?

NetBIOS, RPC, and login sessions

Which of the following is an Application layer protocol used for name resolution?

DNS

SMTP, POP3, and IMAP are Application layer protocols used for which service?

Email

Which Transport layer protocol is connection-oriented and provides reliable delivery?

TCP

Which characteristic best describes UDP compared to TCP?

Low overhead and fast, with no guaranteed delivery

What identifies the application associated with a Transport layer communication?

Port number

At the Network layer, what kind of address identifies a device across networks?

IP address (logical address)

Which protocols operate at the OSI Network layer?

IP, ICMP, OSPF, and BGP

Packet fragmentation, when needed, is handled by which OSI layer?

Network layer (Layer 3)

How does the Data Link layer detect errors in received frames?

Using a Cyclic Redundancy Check (CRC)

Which protocols are associated with the Data Link layer?

Ethernet (802.3) and Wi-Fi (802.11)

Which of the following does the Physical layer define?

Electrical, optical, or radio signals, voltage levels, and signal timing

In the OSI model, the upper layers (5, 6, and 7) are often grouped as which category?

Software layers

How many layers does the TCP/IP model commonly have?

4 (sometimes described as 5)

The TCP/IP Internet layer corresponds to which OSI layer?

Network layer (Layer 3)

The TCP/IP Transport layer corresponds to which OSI layer?

Transport layer (Layer 4)

Which protocols are listed for the TCP/IP Internet layer?

IP, ICMP, and ARP

Which organization is credited with developing the TCP/IP model?

DoD / IETF

In practice, why do engineers still use OSI layer numbers (such as "Layer 3 switch")?

OSI numbers are used to describe concepts, while TCP/IP protocols are used for actual communication

During encapsulation, in what order is the data transformed from the Application layer down to the Physical layer?

Data, Segment, Packet, Frame, Bits

What part of a PDU carries the actual user information rather than control information?

The payload

According to the slides, what does PDU stand for?

Protocol Data Unit

What does PCI (Protocol Control Information) refer to in a layered model?

The header and/or trailer added by each layer

What is a Service Access Point (SAP)?

The interface between adjacent layers

Which device operates at the Physical layer and simply regenerates or repeats signals to all ports?

Hub

A router makes forwarding decisions based on which type of address?

IP address (Layer 3)

A firewall that filters traffic based on IP addresses and TCP/UDP port numbers operates at which OSI layers?

Network and Transport layers (Layers 3 and 4)

Which organization manages Internet standards published as RFCs?

IETF (Internet Engineering Task Force)

Which standards organization is part of the United Nations and focuses on telecommunication standards?

ITU (International Telecommunication Union)

Which RFC defines TCP (Transmission Control Protocol)?

RFC

Which RFC number corresponds to the very first RFC, "Host Software"?

RFC 1

What is the definition of a protocol given in the slides?

The rules for the format, order, and actions of messages exchanged between communicating entities

What is the main reason for using a layered architecture in networking?

Complexity management — breaking a huge problem into smaller, manageable parts

Which benefit of layering means each layer only needs to know the interface of adjacent layers?

Abstraction

A LAN speed is given as "1-10 Gbps" in the slides. What does Gbps measure?

Data rate (gigabits per second)

Bit rate, voltage levels, and signal timing are defined at which OSI layer?

Physical layer (Layer 1)

The Data Link layer adds both a header and a trailer to data from Layer 3. What is the trailer field used for error detection commonly called?

Frame Check Sequence (FCS)

During encapsulation, which layer adds the header that turns "Data" into a "Segment"?

The Transport layer (Layer 4)

A device described as operating at "Layer 3" forwards data based on which information?

Logical IP addresses

When two hosts negotiate, maintain, and gracefully end a logical conversation independent of the underlying transport connection, which OSI layer is conceptually responsible?

Session layer (Layer 5)

In the TCP/IP model, the Session, Presentation, and Application layers of OSI are combined into a single Application layer.

True