Cybersecurity-Apprentice Network Fundamentals Practice Test 5 — 15 Questions

Question 1

A junior administrator is documenting the TCP/IP model layers for a training manual. The administrator needs to map the OSI model's Transport layer to its equivalent layer in the TCP/IP model. Which layer of the TCP/IP model corresponds to the OSI Transport layer?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Transport layer. The TCP/IP model's Transport layer is the direct counterpart to the OSI Transport layer. Both handle end-to-end data transfer, segmentation, and port addressing. The Internet layer aligns with OSI Network, while the Network Access layer covers OSI Data Link and Physical. The Application layer aggregates the top three OSI layers. Correctly mapping these layers is essential for troubleshooting and for understanding where protocols like TCP and UDP operate.

Answer

Network Access layer

Answer

Application layer

Answer

Internet layer

Question 2

A security analyst is reviewing how data moves through the TCP/IP stack. She needs to identify TWO protocols that operate at the Transport layer and provide end-to-end communication between applications on different hosts. (Choose two.)

Accepted Answer

TCP. TCP and UDP are the two core Transport layer protocols in the TCP/IP model. TCP provides reliable, connection-oriented delivery, while UDP offers connectionless, best-effort delivery. Both use port numbers to multiplex application data between hosts. IP and ICMP work at the Internet layer, and ARP resolves link-layer addresses, so none of those provide the end-to-end application transport the analyst requires.

Answer

ARP

Answer

ICMP

Answer

IP

Question 3

A junior SOC analyst is examining a packet capture taken from a workstation that is failing to reach an internal web server. The capture shows the workstation sending a frame with destination MAC address 01:00:5E:00:00:FB and a destination IP address of 224.0.0.251. What is the workstation most likely attempting to do?

Accepted Answer

Send an IPv4 multicast packet to the mDNS group address. The multicast MAC 01:00:5E:00:00:FB corresponds to IPv4 multicast group 224.0.0.251, the mDNS address. A host sending to this group is performing multicast DNS name resolution or service discovery on the local segment. Recognizing the 01:00:5E prefix and the 23-bit mapping to the IPv4 multicast range lets the analyst identify the traffic correctly and then investigate why mDNS may be blocked, causing name resolution to fail for the internal server.

Answer

Initiate a TCP three-way handshake with the web server on port 80

Answer

Broadcast an ARP request to resolve the web server's MAC address

Answer

Perform a DHCPv4 broadcast to obtain a new IP lease

Question 4

A network engineer is troubleshooting an issue where a Palo Alto Networks firewall is not installing a static route into the virtual router's forwarding table. The route is configured with a next-hop IP address that is not directly connected to any interface on the firewall. What is the most likely reason the route is not active?

Accepted Answer

The static route's next-hop IP address must be reachable via a connected or other active route for the static route to be installed.. For a static route to be installed in the virtual router's forwarding table, its next-hop must be reachable through an existing active route. If the next-hop is not directly connected and no other route provides a path to it, the static route stays inactive. Ensuring next-hop reachability, often via a connected or default route, is essential for the route to take effect.

Answer

Static routes with a next-hop that is not directly connected are always rejected and must use an interface instead.

Answer

The virtual router must have OSPF enabled for any static route with an indirect next-hop to become active.

Answer

The static route's administrative distance is too high and must be lowered to 1 for the route to be installed.

Question 5

A network technician is configuring a small branch office where the ISP provides a single public IPv4 address. Multiple internal hosts must reach the internet simultaneously using that one address. Which technology should the technician implement?

Accepted Answer

Network Address Translation (NAT). NAT lets a router translate private internal addresses to a single public address, tracking each conversation by port so many hosts can share one connection. That matches the branch office situation exactly: the ISP supplies one public IPv4 address, but numerous devices need simultaneous internet access. VLANs, link aggregation, and STP solve segmentation, bandwidth, and loop problems, not address sharing.

Answer

Virtual LAN (VLAN) tagging

Answer

Link Aggregation (LACP)

Answer

Spanning Tree Protocol (STP)

Question 6

A network technician is troubleshooting a connectivity issue between two hosts on the same VLAN. The technician suspects a duplicate IP address on the network. Which command should the technician use on a Windows host to display the MAC address associated with an IP address in the local ARP cache?

Accepted Answer

arp -a. The arp -a command is the standard Windows utility to view the ARP cache, which contains IP-to-MAC mappings for recently communicated hosts on the local subnet. Duplicate IP addresses often manifest as conflicting MAC entries or unexpected MAC addresses for a known IP. Other commands like ipconfig, netstat, and nslookup serve different purposes and do not expose ARP cache contents, making arp -a the correct choice for this Layer 2 troubleshooting task.

Answer

ipconfig /all

Answer

netstat -ano

Answer

nslookup

Question 7

A new administrator is documenting the address scheme of a small office network. She notes that workstations use addresses in the 192.168.1.0/24 range and that these addresses are not routable on the public Internet. Which type of address is she documenting?

Accepted Answer

Private IP addresses. The 192.168.1.0/24 range falls within the RFC 1918 private address space, specifically 192.168.0.0/16. Private addresses are not routable on the public Internet and require network address translation to communicate externally. Public addresses are globally routable, multicast addresses serve groups, and loopback addresses refer to the local host, so only the private designation fits the administrator's observation.

Answer

Public IP addresses

Answer

Multicast addresses

Answer

Loopback addresses

Question 8

An administrator is assigning IPv4 addresses to devices in a lab subnet. One host must be configured so that it can always be reached at the same address by other lab systems, and it must not depend on a DHCP server being available. Which configuration approach should the administrator use?

Accepted Answer

Configure the host with a static IP address, subnet mask, and default gateway.. A static IP configuration writes the address, mask, and gateway directly into the host, so the device always uses the same address whether or not a DHCP server is running. That satisfies both requirements: predictable reachability and independence from DHCP. Reservations and automatic leases still require the DHCP server, and APIPA produces non-routable link-local addresses.

Answer

Configure the host to obtain an address automatically with a short lease time.

Answer

Reserve the address on the DHCP server using the host's MAC address.

Answer

Enable APIPA so the host self-assigns an address from 169.254.0.0/16.

Question 9

A help desk technician reports that a user's workstation can reach servers on the local /24 subnet but cannot reach any host on a remote subnet. The workstation has IP address 10.20.30.45/24 and default gateway 10.20.30.1. The technician runs ipconfig and sees the correct address and mask, but pinging 10.20.40.10 fails. Which troubleshooting step should the technician perform FIRST to determine whether the problem is local or beyond the gateway?

Accepted Answer

Ping the default gateway 10.20.30.1 from the workstation. Testing the default gateway isolates the failure domain. A successful ping to 10.20.30.1 proves the workstation's IP configuration, ARP resolution, and local switching are functional, pointing the investigation toward routing or filtering beyond the first hop. A failed ping narrows the problem to the local segment, the gateway interface, or the workstation's own stack. This first-hop test is quick, non-disruptive, and directs further effort efficiently.

Answer

Disable the Windows firewall on the workstation and retry the ping

Answer

Check the ARP cache for an entry for 10.20.40.10

Answer

Run a traceroute to 10.20.40.10 to see where packets stop

Question 10

A help desk technician is explaining basic network concepts to a new hire. The technician needs to describe which protocol operates at the Transport layer of the OSI model and provides reliable, connection-oriented delivery. Which protocol should the technician identify?

Accepted Answer

TCP. TCP is the Transport layer protocol that provides reliable, connection-oriented delivery through mechanisms such as the three-way handshake, sequence numbers, acknowledgments, and retransmissions. UDP is connectionless, while ICMP and ARP serve Network layer and address resolution functions respectively. Identifying TCP correctly is fundamental to understanding how applications achieve dependable data transfer.

Answer

ARP

Answer

ICMP

Answer

UDP

Question 11

A security analyst is reviewing network traffic and observes a series of TCP packets where the flags field is set to SYN, then SYN-ACK, then ACK. The analyst needs to document the purpose of this exchange. What is the primary function of this three-way handshake?

Accepted Answer

To establish a reliable, connection-oriented session between two hosts. The TCP three-way handshake is designed to establish a reliable, connection-oriented session. The client sends a SYN to initiate, the server responds with SYN-ACK to acknowledge and synchronize, and the client sends an ACK to complete the process. This exchange synchronizes sequence numbers, confirms bidirectional communication, and sets the stage for reliable data transfer. Other options describe functions of TLS, ARP, or DHCP, which are unrelated to TCP connection establishment.

Answer

To negotiate encryption algorithms before data transfer

Answer

To assign a dynamic IP address to a client from a pool

Answer

To resolve an IP address to a MAC address on the local network

Question 12

A security analyst is reviewing a packet capture of a TCP session between an internal client and an external server. The capture shows the client sending a segment with the SYN flag set and the server responding with a segment that has both SYN and ACK set. The client then sends an ACK. What does this sequence indicate about the session?

Accepted Answer

The TCP three-way handshake completed and the connection is established. The three segments SYN, SYN+ACK, and ACK are the canonical TCP three-way handshake. The client proposes a connection with SYN, the server acknowledges and proposes its own sequence with SYN+ACK, and the client confirms with ACK. Completion of this exchange places both endpoints in the ESTABLISHED state, allowing application data to be exchanged. Recognizing this pattern helps the analyst distinguish normal session setup from resets, retransmissions, or teardown traffic.

Answer

The session is being torn down gracefully by both endpoints

Answer

The client is retransmitting a lost SYN because the server did not respond

Answer

The server is rejecting the connection and resetting the session

Question 13

An analyst is troubleshooting why a workstation with IP address 172.16.5.20/24 cannot communicate with a server at 172.16.6.10/24, even though both are connected to the same Layer 2 switch and the switch shows both ports up. The analyst confirms there are no VLAN or ACL restrictions. Which network fundamental best explains the failure?

Accepted Answer

The two hosts are on different IP subnets and require a router or Layer 3 device to communicate. IP communication depends on subnet boundaries, not physical topology. Hosts on 172.16.5.0/24 and 172.16.6.0/24 are on separate logical networks even when cabled to the same switch. A host forwards off-subnet traffic to its default gateway, so without a router or Layer 3 switch providing inter-subnet routing, the two hosts cannot exchange packets. Confirming subnet membership and the presence of a Layer 3 path is essential before blaming switching or ACLs.

Answer

The switch is blocking traffic because the MAC address table has not learned the server's MAC address

Answer

The server's /24 mask is too large and causes it to treat the workstation as local

Answer

The workstation is using the wrong default gateway, which prevents ARP from resolving the server

Question 14

A network engineer is analyzing a packet capture and notices that a host is sending a series of ICMP Echo Requests to a remote server. The host receives ICMP Echo Replies, but the payload sizes vary. The engineer wants to determine the maximum transmission unit (MTU) of the path to avoid fragmentation. Which protocol or mechanism is used to discover the path MTU?

Accepted Answer

Path MTU Discovery (PMTUD). Path MTU Discovery (PMTUD) is the correct mechanism for determining the maximum transmission unit along a network path. It uses the Don't Fragment (DF) flag in IP packets; when a router cannot forward a packet because it exceeds the next link's MTU, it sends an ICMP Fragmentation Needed message back to the sender. The sender then reduces the packet size. This process avoids fragmentation and optimizes performance. ARP, DHCP, and DNS serve different purposes and are not involved in MTU discovery.

Answer

Dynamic Host Configuration Protocol (DHCP)

Answer

Domain Name System (DNS)

Answer

Address Resolution Protocol (ARP)

Question 15

A network security analyst is reviewing how a host on a corporate LAN resolves names and discovers services. The analyst wants to identify TWO protocols or mechanisms that operate at the application layer and rely on UDP for transport. (Choose two.)

Accepted Answer

mDNS queries on the local segment. DNS to a recursive resolver and mDNS both operate at the application layer and use UDP. DNS favors UDP for its small, fast request-response exchanges on port 53, while mDNS uses UDP multicast on port 5353 for local name resolution and service discovery. HTTP, SMTP, and SSH are application-layer protocols but rely on TCP for reliable transport, so they do not meet the stated criterion.

Answer

SMTP delivery between mail servers

Answer

SSH remote administration sessions

Answer

HTTP requests to a web server on port 80