ISC2 CC Network Security Practice Question
A network administrator is troubleshooting connectivity issues and suspects a problem at the Data Link layer. Which of the following addresses would be most relevant to examine?
⚠ Common exam trap
The trap is confusing OSI layer responsibilities — candidates may pick IP address because it is commonly used in troubleshooting, but the CC exam specifically tests that MAC addresses belong to Layer 2 while IP addresses belong to Layer 3.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
MAC address
The Data Link layer (Layer 2) of the OSI model deals with MAC addresses for node-to-node delivery within a local network segment. When troubleshooting connectivity issues at Layer 2, the MAC address is the most relevant address to examine because it identifies the physical network interface and is used by switches to forward frames. IP addresses operate at Layer 3, port numbers at Layer 4, and domain names at Layer 7, so they are not relevant to a Data Link layer problem.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
IP address
Why it's wrong here
IP addresses are Layer 3 logical identifiers, so they do not identify the Layer 2 hardware endpoints involved in a Data Link fault. It tempts because IP addresses are examined when troubleshooting routing or reachability problems, which is the correct focus when the fault sits at the Network layer.
- ✓
MAC address
Why this is correct
MAC addresses operate at the Data Link layer, uniquely identifying network interfaces within a local segment. Examining them reveals framing, switching and ARP-related faults, directly satisfying the stem's constraint of isolating a Layer 2 connectivity problem.
- ✗
Port number
Why it's wrong here
Port numbers are Layer 4 identifiers for TCP and UDP sessions, so they reveal nothing about Layer 2 framing or addressing. It tempts because ports are examined when troubleshooting transport-layer connectivity, such as a blocked service or firewall rule, which is the correct focus when the fault sits above the Data Link layer.
- ✗
Domain name
Why it's wrong here
Domain names are resolved by DNS at the Application layer and carry no Data Link significance, so they cannot identify a Layer 2 fault. It tempts because domain names are examined when troubleshooting name resolution failures, which is the correct focus when connectivity breaks above the Data Link layer.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
One of 989 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.