Courseiva
Network+ Study GuideCompTIA Network+ N10-009

OSI Model for Network+: All 7 Layers with Protocols and Real Exam Examples

All seven OSI layers, the protocols that live at each layer, mnemonic devices, and how CompTIA Network+ N10-009 questions map concepts to layers.

5 min read
10 sections
Courseiva Study Hub
JA

Reviewed by Johnson Ajibi, MSc IT Security

12+ years in network and security engineering · Founder, JTNetSolutions Limited & Courseiva

GitHubEditorial policyTrust Center

Quick answer

All seven OSI layers, the protocols that live at each layer, mnemonic devices, and how CompTIA Network+ N10-009 questions map concepts to layers.

In this guide

  1. 1.Mnemonic Devices to Remember the Layers
  2. 2.Layer 7 – Application
  3. 3.Layer 6 – Presentation
  4. 4.Layer 5 – Session
  5. 5.Layer 4 – Transport
  6. 6.Layer 3 – Network
  7. 7.Layer 2 – Data Link
  8. 8.Layer 1 – Physical
  9. 9.Exam Tips: What to Watch For
  10. 10.Conclusion

OSI Model for Network+: All 7 Layers with Protocols and Real Exam Examples

The OSI (Open Systems Interconnection) model is a foundational concept for the CompTIA Network+ N10-009 exam. You will see at least 5–10 questions that directly test your ability to map protocols, devices, and troubleshooting steps to the correct OSI layer. This post breaks down each layer with the protocols you must know, mnemonics to memorize the order, and how exam questions will ask you to apply this knowledge.

Mnemonic Devices to Remember the Layers

From Layer 7 (top) to Layer 1 (bottom):

  • All People Seem To Need Data Processing
  • Please Do Not Throw Sausage Pizza Away

Layer 7: Application Layer 6: Presentation Layer 5: Session Layer 4: Transport Layer 3: Network Layer 2: Data Link Layer 1: Physical

Layer 7 – Application

This is the layer closest to the end user. It provides network services to applications. Protocols operate here, not the applications themselves.

Key protocols for Network+:

  • HTTP/HTTPS (port 80/443)
  • FTP (ports 20, 21)
  • TFTP (port 69)
  • SMTP (port 25)
  • POP3 (port 110)
  • IMAP (port 143)
  • DNS (port 53) — DNS also works at Layer 7 even though it uses UDP; it is an application-layer protocol.
  • DHCP (ports 67, 68)

Exam example: A user cannot access a web page. The browser displays "connection timed out." Which layer is most likely the issue? Answer: Application layer (Layer 7) if the server is reachable but the web service is not responding.

Layer 6 – Presentation

This layer translates data between the application and the network. It handles encryption, compression, and character encoding.

Key concepts:

  • SSL/TLS encryption (though often associated with Layer 4 in practice, the handshake and certificate exchange happen at Layer 6)
  • ASCII, EBCDIC, JPEG, GIF, MPEG
  • Data formatting and serialization

Exam example: A network administrator notices that encrypted web traffic is failing to decrypt properly. Which OSI layer is responsible? Answer: Presentation layer.

Layer 5 – Session

Manages sessions (connections) between applications. It establishes, maintains, and terminates sessions.

Key protocols:

  • NetBIOS
  • RPC (Remote Procedure Call)
  • PPTP (Point-to-Point Tunneling Protocol)
  • SIP (Session Initiation Protocol) for VoIP

Exam example: A VoIP call drops after 30 seconds. The issue might be at the Session layer if the session is being terminated prematurely.

Layer 4 – Transport

Provides reliable or unreliable delivery and error recovery. This is a critical layer for the exam.

Key protocols:

  • TCP (Transmission Control Protocol) — connection-oriented, reliable, uses sequence numbers and acknowledgments. Port numbers live here.
  • UDP (User Datagram Protocol) — connectionless, no reliability, used for streaming, DNS, DHCP.

Key concepts:

  • Three-way handshake (SYN, SYN-ACK, ACK)
  • Windowing, flow control
  • Multiplexing using port numbers

Exam example: A network technician runs netstat -an and sees many connections in SYN_SENT state. Which layer is experiencing a problem? Answer: Transport layer (TCP handshake not completing).

Layer 3 – Network

Responsible for logical addressing (IP addresses) and routing. This is where routers operate.

Key protocols:

  • IP (IPv4, IPv6)
  • ICMP (ping, traceroute)
  • ARP — ARP resolves IP to MAC addresses; it is often considered a Layer 3 protocol but actually works between Layers 2 and 3 (some say Layer 2.5). For Network+, know ARP as a critical protocol for IP communication.
  • Routing protocols: OSPF, EIGRP, BGP (but these are often tested separately)

Key concepts:

  • IP addressing, subnetting
  • Routing tables
  • Packet forwarding

Exam example: A ping from PC A to PC B fails with "Destination Host Unreachable." Which layer is the likely problem? Answer: Network layer (routing issue or incorrect IP configuration).

Provides node-to-node data transfer and handles error detection from the Physical layer. Switches and bridges operate here. MAC addresses are used.

Key protocols:

  • Ethernet (IEEE 802.3)
  • PPP (Point-to-Point Protocol)
  • HDLC
  • VLANs (802.1Q)
  • STP (Spanning Tree Protocol)

Key concepts:

  • MAC addresses
  • Frame structure (preamble, destination MAC, source MAC, EtherType, payload, FCS)
  • CSMA/CD (for legacy Ethernet)

Exam example: A switch port shows many CRC errors. Which layer is affected? Answer: Data Link layer (frame corruption detected via FCS).

Layer 1 – Physical

Transmits raw bit streams over the physical medium. Cables, connectors, hubs, repeaters, and signal types are here.

Key concepts:

  • Cable types: Cat5e, Cat6, fiber (single-mode, multi-mode)
  • Connectors: RJ45, LC, SC, ST
  • Signal types: electrical, light, radio waves
  • Maximum cable lengths
  • Troubleshooting with a cable tester or time-domain reflectometer (TDR)

Exam example: A user cannot connect to the network. The link light on the NIC is off. Which layer is the problem? Answer: Physical layer.

Exam Tips: What to Watch For

  • Layer identification from symptoms: The exam often describes a problem (e.g., "users can't access a website but can ping the server"). You must identify the layer. If ping works (Layer 3) but HTTP fails (Layer 7), the issue is likely at Layer 7.
  • Protocol-to-layer mapping: Know which protocols belong to which layers. For example, DNS is Layer 7 even though it uses UDP (Layer 4).
  • Device-to-layer mapping:
    • Hub/Repeater: Layer 1
    • Switch/Bridge: Layer 2
    • Router: Layer 3
    • Multilayer switch: Layers 2 and 3
    • Firewall: often Layer 4 (stateful) or Layer 7 (application firewall)
  • Encapsulation: Remember that data moves down the layers, adding headers (segment, packet, frame, bits). The exam may ask about the PDU (Protocol Data Unit) at each layer: Application = data, Transport = segment, Network = packet, Data Link = frame, Physical = bits.
  • Mnemonics: Write the mnemonic at the top of your scratch paper as soon as the exam starts.

Conclusion

Mastering the OSI model is non-negotiable for the Network+ N10-009 exam. Focus on memorizing the layers, the protocols and devices at each layer, and how to map troubleshooting scenarios to the correct layer. Practice with sample questions that ask "Which layer?" to build speed and accuracy.

Ready to test your knowledge? Try our free OSI model practice questions to reinforce these concepts before exam day.

Practise Network+ questions

Original exam-style practice questions with detailed, explained answers. Track your weak topics and review missed questions before exam day.

Network+ practice testAll Network+ questions

Courseiva provides free IT certification practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics. Explore related practice questions for Cisco, CompTIA, Microsoft Azure, AWS, and other certification exams.