Ch. 2 OSI Reference Model

What is the range of well-known TCP and UDP ports?

1024. There is a total of 65,536 ports each for TCP and UDP. Of these, only 1,024 ports are considered well known and, therefore reserved for a particular service.

You have recently implemented DNS on a small company network. However, you discover that the internal DNS server is having trouble communicating with external DNS servers. Which well-known UDP port does this protocol use?

53. Ports allow more than one service or application to communicate at the same time between computers. The Domain Name System (DNS) service uses port 53 to communicate information between name servers. DNS uses both TCP port 53 and UDP port 53. Administrators can assign additional ports for communication on an intranet and through the Internet.

Real Time Streaming Protocol (RTSP) can use either TCP or UDP port ____.

554

Dynamic Host Configuration Protocol (DHCP) server uses a default UDP port of ___

67

A router resides at which layer of the OSI Model?

A router is an example of a Layer 3 device, and it forwards packets based on a destination logical address (for example, an IP address).

An Ethernet hub resides at which layer of the OSI Model?

An Ethernet hub is an example of a Layer 1 (that is, Physical Layer) device, and when it receives a bit in on one of its ports, it sends a copy of that bit out all of its other ports.

OSI Layer 7

Application Layer

DNS and DHCP both work at the _______________ layer of the OSI model.

DNS and DHCP both work at the Application layer of the OSI model.

OSI Layer 2

Data Link Layer

What is the common port (that is, "well-known" port) used by DNS?

Domain Name System (DNS) can use either a TCP or UDP port of 53.

Domain Name System (DNS) is a host name resolution protocol that communicates over ______________.

Domain Name System (DNS) is a host name resolution protocol that communicates over TCP and UDP port 53.

File Transfer Protocol (FTP) port

File Transfer Protocol (FTP) communicates over TCP ports 20 and 21 to transfer files.

What is the protocol data unit name for data at Layer 2?

Frame. Layer 2 of the OSI Model (that is, the Data Link Layer) views a unit of data (that is, a protocol data unit) as a frame (or packet). Note that the term "packet" is used fairly generically to refer to data at Layers 2, 3, and 4. At Layer 1 (that is, the Physical Layer), a unit of data is a bit. At Layer 3 (that is, the Network Layer), a unit of data is a datagram (or packet). At Layer 4 (that is, the Transport Layer), a unit of data is a segment (or packet).

Identify the four layers of the TCP/IP stack.

From the bottom up they are network interface, Internet, transport, and application.

Which unsecure protocol do Web browsers use to access documents on the World Wide Web?

HTTP is an application protocol that works at the Application layer of the OSI model. A Web browser is an HTTP client that sends requests to server machines. The browser builds an HTTP request and sends it to the Internet Protocol address indicated by the URL. The HTTP daemon in the destination server machine receives the request and, after any necessary processing, it returns the requested file. HTTP is considered to be unsecure.

Which two protocols are used to retrieve e-mail from an e-mail server?

Internet Message Access Protocol version 4 (IMAP4) and Post Office Protocol version 3 (POP3) are used to retrieve e-mail from an e-mail server.

An Ethernet switch resides at which layer of the OSI Model?

Layer 2

American Standard Code for Information Interchange (ASCII) would be classified at which layer of the OSI Model?

Layer 6 of the OSI Model (that is, the Presentation Layer) is concerned with data formatting and encryption. Examples of data formatting standards include American Standard code for Information Interchange (ASCII) and Extended Binary Coded Decimal Interchange Code (EBCDIC ).

OSI Layer 3

Network Layer

A network technician contacts you regarding what he believes is suspicious behavior on the network. He has noticed communication over TCP port 123 between his computer and a server on the Internet. Which protocol is causing this communication?

Network Time Protocol (NTP) communicates over TCP port 123. It is responsible for synchronizing the clock settings on a computer. Proper clock synchronization is vital for many directory service applications. Communication over TCP port 123 is not a reason to be alarmed. NTP works at the Application layers of the OSI model.

IP addresses reside at which layer of the OSI reference model?

Network layer

OSI Layer 1

Physical Layer

Post Office Protocol version 3 (POP3) port

Post Office Protocol version 3 (POP3) is an e-mail message retrieval protocol that uses TCP port 110.

OSI Layer 6

Presentation Layer

OSI Layer 5

Session Layer

Which well-known port is used to forward e-mail on the Internet between e-mail servers?

Simple Mail Transfer Protocol (SMTP) uses port 25 to communicate e-mail transfers. Administrators can assign additional ports for communication on an intranet and through the Internet.

Trivial File Transfer Protocol (TFTP) communicates over port...

Trivial File Transfer Protocol (TFTP) communicates over UDP port 69 to transfer files.

Sends messages, called datagrams, to other hosts on an Internet Protocol (IP) network without prior communications to set up special transmission channels or data paths. It operates on the Transport layer of the Internet protocol suite (the TCP/IP model).

User Datagram Protocol (UDP)

The Telnet command syntax is as follows:

telnet abcdef.com [port #]

a DHCP client uses a default UDP port of ____.

68

The Session, Presentation, and Application Layers (that is, Layers 5, 6, and 7) of the OSI Model correspond to the ____ Layer of the TCP/IP Stack.

Application

You have several switches and routers on your company's network. The switches are not experiencing any problems. However, one of the routers is not correctly routing packets based on IP addresses. At which layer of the OSI model does the problem device operate?

Network layer (Layer 3) of the OSI networking model. They use source and destination addresses, which are located at the Network layer, to route packets. On the other hand, switches use MAC addresses, which are located at the Data Link layer (Layer 2), to forward frames. An example of an issue that occurs at the Network layer is when computers are connected to the same switch but receive error messages and cannot communicate.

A corporate e-mail service would be classified as belonging to what Layer of the OSI Model?

The Application Layer (that is, Layer 7) of the OSI Model is concerned with application services (for example, file sharing and e-mail) and service advertisement.

You are analyzing communication over your network. You have captured all the packets sent to and from a server on your network. You need to filter the packet capture to only IMAP4 protocol communications. Which port does this protocol use?

TCP port 143

Telnet and FTP both work at the ______________ layer of the OSI model.

Telnet and FTP both work at the Application layer of the OSI model.

You are using DSL to connect to the Internet. You recently set up firewall software to protect your computer's resources from external users. After setting up the firewall software, you can no longer access Web sites by name. What is the problem?

Your firewall software is blocking port 53. Port 53 is the port associated with the Domain Name Service (DNS). If this port is blocked by firewall software, you will not be able to access computers on the Internet by their fully qualified domain names (FQDNs), such as www.comptia.org or www.kaplanittraining.com.

Internet Message Access Protocol version 4 (IMAP) uses a default TCP port of ___.

143

What is the common TCP port (that is, "well-known" port) used by Telnet?

23

What TCP port is used by RDP?

3389

Remote Shell (rsh) uses a default TCP port of ____.

514

Hypertext Transfer Protocol (HTTP) uses a default TCP port of ___.

80

Internet Protocol (IP) resides at what layer of the OSI Model?

IP resides at the Network Layer (that is, Layer 3) of the OSI Model.

What is the common TCP port (that is, "well-known" port) used by IMAP?

Internet Message Access Protocol version 4 (IMAP) uses a default TCP port of 143.

NetBIOS is associated with which layer of the OSI Model?

NetBIOS is considered to be a Session Layer (that is, Layer 5) protocol, responsible for setting up, maintaining, and tearing down sessions. Network Basic Input/Output system (NetBIOS) is an application programming interface (API) developed in the early 80s to allow computer-to-computer communication on a small local area network (LAN). Later, IBM enhanced the scalability and features of NetBIOS with a NetBIOS emulator called NetBIOS Extended User Interface (NetBEUI).

Which layer of the OSI Model is concerned with logical addressing?

Network. The Network Layer (that is, Layer 3) of the OSI Model is concerned with logical addressing, switching (that is, packet switching, not frame switching), route discovery and selection, connection services, bandwidth usage, and multiplexing strategy. An IP address is an example of a logical address found at the Network Layer. However, the Application Layer is concerned with application services and service advertisement. The Transport Layer is concerned with Transmission Control Protocol (TCP), User Datagram Protocol (UDP), windowing, and buffering. The Data Link Layer divided into two sublayers (MAC and LLC) and is concerned with physical addressing, logical topology, method of transmitting on the media, connection services, and synchronizing transmissions.

SSH and TFTP both work at the ______________ layer of the OSI model.

SSH and TFTP both work at the Presentation layer of the OSI model.

Secure Shell (SSH) communicates over port...

Secure Shell (SSH) communicates over TCP port 22 to allow secure data transfer.

You need to create an encrypted remote terminal connection with a UNIX computer. Which protocol should you use?

Secure Shell (SSH) is used to create an encrypted remote terminal connection with a UNIX computer. File Transfer Protocol (FTP) is used to transfer files on a TCP/IP network. FTP transmits data in clear text. Secure Copy (SCP) enables users to transfer files over a secure connection. Telnet is a protocol that enables a user to establish terminal connections with UNIX computers. Telnet transmits data in clear text.

SSL uses public key cryptography at the ________ layer of the Open Systems Interconnection (OSI) model to secure transactions, such as financial transactions, on the Internet.

Session

Simple Mail Transfer Protocol (SMTP) port

Simple Mail Transfer Protocol (SMTP) is an e-mail message protocol that uses TCP port 25.

What is the common TCP port (that is, "well-known" port) used by SMTP?

Simple Mail Transfer Protocol (SMTP) uses a default TCP port of 25.

Which two protocols are used to connect to a remote host via a terminal emulator?

Telnet and Secure Shell (SSH) are protocols used to connect to a remote host, often via a terminal emulator. SSH is considered to be secure, while Telnet is considered to be unsecure.

Recently, you have noticed that segments of data are arriving at their destination with errors. You need to examine the appropriate OSI layer for the reliable delivery of segments without error. Which OSI layer is responsible for this?

The Transport layer is responsible for the reliable delivery of segments without error. This means that the Transport layer is not only responsible for making sure that segments of data are delivered, but also for ensuring that segments of data arrive without error. The Transport layer uses segment sequencing to put any incorrectly ordered segments into the correct sequence.

The Physical and Data Link Layers (that is, Layers 1 and 2) of the OSI Model correspond to what Layer of the TCP/IP Stack?

the Network Interface Layer of the TCP/IP Stack.

What are the common TCP ports (that is, "well-known" ports) used by FTP?

File Transfer Protocol (FTP) uses default TCP ports of 20 and 21.

Post Office Protocol version 3 (POP3) uses a default TCP port of ___.

110

Network Time Protocol uses a default UDP port of ___.

123

Which approach to bandwidth usage consumes all the available frequencies on a medium to transmit data?

Baseband. Baseband technology uses the entire medium to transmit. You should contrast this to broadband technology, which can divide the medium up into different channels. A great example of broadband is the use of the coaxial cable you might have in your home, which carries cable television signaling as well as high-speed Internet.

You administer a 100BaseTX Ethernet network that is configured to use the TCP/IP network communications protocol. You have installed a firewall between the network and the Internet. Currently ports 80, 20, and 21 are open on the firewall. You want to allow only SMTP and POP3 communications between the network and the Internet. Which configurations should you make on the firewall?

Close ports 20, 21, and 80, and open ports 25 and 110. Currently, ports 80, 20, and 21 are open in the firewall. Port 80 is the port that is used to transfer Hypertext Transfer Protocol (HTTP) messages. HTTP is the protocol that is used to transport Web pages on the Internet. Ports 20 and 21 are used by File Transfer Protocol (FTP), a protocol that can transfer data files on the Internet. An FTP server listens for requests on port 21 and establishes connections with FTP clients on port 20. In this scenario, you should close ports 20, 21, and 80 to prevent HTTP and FTP traffic.

As a network administrator, you understand that there are many types of addresses used in networks, including Data Link layer addresses and network addresses. You need to explain to a new network technician the difference between these two types of addresses. What is the most significant difference?

Data Link layer addresses are MAC addresses for unique identification, whereas network addresses are a Network layer component. The most significant difference between Data Link layer addresses and network addresses is that network addresses are a Network layer component (Layer 3), and Data Link addresses are MAC addresses (Layer 2) used for unique identification. Network addresses refer to logical networks, whereas Data Link addresses define an actual physical address assigned to a network interface card (NIC). Data Link layer addresses define the physical device, and network addresses define the logical device. Data Link layer addresses (MAC addresses) are 48 bits, and a TCP/IP network address is 32 bits (IPv4) or 128 bits (IPv6). This is not a significant difference. The network address is configured by the network administrator. The first six hexadecimal digits of the Data Link (MAC) address are specified by the IEEE according to the NIC's vendor ID; this is known as the Organizationally Unique Identifier (OUI).

Which of the following protocols is used for transferring files with a remote host in a non-secure fashion?

File Transfer Protocol (FTP) is used to transfer files with a remote host in a non-secure fashion.

You use a computer on a TCP/IP network to transfer data through well-known TCP port 80. Which protocol is most likely being used to transfer data?

Hypertext Transfer Protocol (HTTP) is assigned to the well-known Transmission Control Protocol (TCP) port 80, so you are most likely using HTTP to transfer data. HTTP is used to transfer data between Web browsers and Web servers on a TCP/IP network. HTTP is a stateless protocol, which means that neither the server nor the client collects or maintains information about one another. HTTP works at the Application layer (Layer 7) of the OSI model.

What is the common TCP port (that is, "well-known" port) used by HTTP?

Hypertext Transfer Protocol (HTTP) uses a default TCP port of 80.

What is the common TCP port (that is, "well-known" port) used by HTTPS?

Hypertext Transfer Protocol Secure (HTTPS) uses a default TCP port of 443.

The Network Layer of the OSI Model corresponds to what layer of the TCP/IP Stack?

Internet

Sends error messages indicating, for example, that a requested service is not available or that a host or router could not be reached. It operates on the Internet layer of the Internet protocol suite (the TCP/IP model). ___________ errors are sent to the source IP address of the originating packet. It is the protocol used by the ping command to verify connectivity.

Internet Control Message Protocol (ICMP)

You notice that several ping requests have been issued on your network in the past couple of hours. Which protocol responds to these requests?

Internet Control Message Protocol (ICMP)

Which of the following are sublayers of the Data Link Layer (that is, Layer 2) of the OSI Model?

Layer 2 of the OSI Model (that is, the Data Link layer) contains two sublayers, the Media Access Control (MAC) and Logical Link Control (LLC) sublayers. However, Point-to-Point Protocol (PPP) is a Layer 2 encapsulation type, and Link Access Procedure on the D Channel (LAPD) is a Layer 2 protocol used by Integrated Services Digital Network (ISDN).

You suspect that there is a problem with addressing that allows data to be sent throughout your network. Which addressing method is used at the OSI Network layer to allow this?

Logical network addressing. Although the OSI Data Link layer (Layer 2) uses MAC, or physical device, addressing, the Network layer (Layer 3) uses logical network addressing. This logical address is defined by the protocol's addressing scheme. For example, an IPv4 TCP/IP address is composed of 32 bits, divided into four sets of decimal numbers divided by periods. An IPX address is a combination of an 8-digit hexadecimal number, which is assigned by the network administrator, and a 12-digit MAC address, separated by a colon. Service addressing is the other addressing method used by the OSI Network layer. It is used to identify a specific upper-layer process or protocol. A service address is also known as a port or socket.

What protocol is used to synchronize a network device's clock with a time server?

Network Time Protocol (NTP) is used by a network device to synchronize its clock with a time server (that is, an NTP server).

As a network administrator, you decide to replace a hub on your network with an active hub. At which OSI layer does the new device function?

Physical. Active hubs or multiport repeaters amplify or regenerate signals to all other ports on the hub. Because active hubs regenerate signals, they are often used to extend the length of segments beyond their maximum specified lengths. They, as with all hubs, are considered Physical layer devices (Layer 1) because they act on the data at the bit level. If you have a problem where a computer is unable to reach the Internet, the technician should be troubleshooting at the Physical layer.

Which protocol is not capable of preventing a man-in-the-middle attack?

RSH. The remote shell (RSH) protocol is used to log on to remote computers and can be easily exploited by a man-in-the middle (MITM) attack because it neither provides encryption nor authentication of data. In a MITM attack, an intruder captures the traffic of an established connection to intercept the messages being exchanged between the sender and the receiver. The RSH protocol does not provide security because the traffic flows in clear text and not ciphertext. You can defend against a MITM attack by using strong encryption.

You administer your company's 100BaseTX Ethernet network. TCP/IP is the networking protocol used on the network. You want the routers on the network to send you notices when they have exceeded specified performance thresholds. Which protocol should you use to enable the routers to send the notices?

SNMP. You should use Simple Network Management Protocol (SNMP) to enable the routers to notify you when they exceed specified performance thresholds. SNMP is a protocol in the TCP/IP protocol suite that enables the collection of data about various devices connected to a TCP/IP network, including bridges, hubs, and routers. Each SNMP-compatible device has a Management Information Base (MIB) database that defines the type of information that can be collected about the device. You can also configure SNMP traps to analyze network performance and network problems. A trap is a message that an SNMP-compatible device sends when the device has exceeded a performance threshold. You can configure SNMP to send traps to the network management software you are using, to your e-mail address, or to another destination. SNMP works at the Application layer of the OSI model. SNMP monitors are the pieces of software that actually monitor managed devices. This software must be applied at the device level.

Which protocol supports a secure connection to a remote host via terminal emulation software?

Secure Shell (SSH) provides a secure alternative to Telnet when it comes to remotely accessing a network device for management of that device.

What is the common TCP port (that is, "well-known" port) used by SSH?

Secure Shell (SSH) uses a default TCP port of 22.

You need to provide terminal emulation and remote login capability for one of the servers on your network. Which Process/Application layer protocol should you use?

Telnet is a user command and an underlying TCP/IP protocol for accessing remote hosts. The HTTP and FTP protocols allow you to request specific files from remote hosts without having to log on as a user of that host computer. The Telnet protocol, however, allows you to log on as a regular user with the associated privileges that you have been granted to the specific application and data on that host. In other words, you appear to be locally attached to the remote system. A subset of the Telnet protocol is also used in other application protocols, such as FTP and SMTP.

You are examining the packets captured on your network. You notice some communication between your Cisco router and someone from outside your network. The packets indicate that the communication is occurring over TCP port 23. Which protocol is being used?

Telnet is the protocol that communicates over TCP port 23. Telnet is a protocol that allows users to access remote computers and devices. Cisco routers can be configured to allow remote administration though this protocol.

Who developed the TCP/IP Stack network reference model (also known as the TCP/IP Model)?

The Department of Defense (DoD) developed the TCP/IP Stack, which is a network reference model consisting of the following layers (from the bottom up): Network Interface, Internet, Transport, and Application. The International Standards Organization (ISO), developed the Open Systems Interconnect (OSI) Model. The IEEE is the Institute for Electrical and Electronics Engineers and is responsible for a wide variety of networking standards. Similarly, the International Telecommunication Union (ITU) is responsible for many networking standards.

Identify the well-known UDP port number for NTP.

The Network Time Protocol (NTP) relies on port 123.

Which layer of the OSI Model is concerned with how bits are represented on the medium?

The Physical Layer, residing at the bottom of the OSI Model (that is, Layer 1) is concerned with how bits are represented on the medium, wiring standards, physical topology, synchronizing bits, bandwidth usage, and multiplexing strategy.

You have installed a new MAU on your Token Ring network because the old one is no longer supported by the product vendor. At what layer of the OSI model does this device operate?

The Physical layer. A Multistation Access Unit (MAU) operates at the Physical layer (Layer 1). A MAU is a network connection concentrator used on Token Ring networks. A MAU is similar to a hub, which is a network connection concentrator used on star-wired Ethernet networks.

Which layer of the OSI reference model contains the MAC and LLC sublayers?

The data link layer of the OSI model is the only layer of the famous model that we typically divide into sublayers (the MAC and LLC sublayers).

To improve security, you change your Web server named Web1 to the HTTPS protocol. Shortly after implementing the change, users report that they cannot access any Web sites hosted on Web1 by using their fully qualified domain names (FQDNs). However, they can access other Web sites that are hosted on other Web servers by using their FQDNs. What is causing this problem?

The new Web address starts with https instead of http. HTTPS is a supported protocol. When a Web server uses HTTPS technology, all the data transfer between clients and the server is encrypted using Secure Sockets Layer (SSL) technology. Web pages using this technology begin their Uniform Resource Locators (URLs) with https://. This technology is used frequently with e-commerce Web sites. In this scenario, users are probably attempting to access the Web sites by typing http:// instead of https://. Although users are unable to access any Web sites hosted on Web1 by using FQDNs, they are able to access other Web sites by using their FQDNs. Therefore, the Domain Name Service (DNS) server is operational, as is the network.

You use a computer named Wkst1 on a TCP/IP network, which is installed with an application that uses UDP to send a file from your computer to a computer named Wkst2. Data collisions occur, and several data packets are lost during transmission. What will most likely occur as a result of losing the packets during transmission?

The protocol will drop the packets, The application will automatically retransmit the packets.

Windowing is provided at what layer of the OSI reference model?

The transport layer offers TCP and UDP. With TCP, a connection-oriented protocol, windowing can be used to dictate how much data is sent at one time.

Provides reliable, ordered, and error-checked delivery of data between applications running on hosts communicating over an IP network. It operates on the Transport layer of the Internet protocol suite (the TCP/IP model). ________ is the protocol is used by the World Wide Web, email, remote administration, and file transfer applications.

Transmission Control Protocol (TCP)

What are the two primary protocols found at the Transport Layer of the TCP/IP Stack?

Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) both reside at the Transport Layer of the TCP/IP Stack (and the Transport Layer of the OSI Model). TCP is considered to be a connection-oriented protocol, while UDP is considered to be a connectionless protocol.

Which TCP port is the well-known port assigned to SSL?

Transmission Control Protocol (TCP) port 443 is the well-known port assigned to Secure Sockets Layer (SSL).

OSI Layer 4

Transport Layer

Which of the following protocols is used for transferring files with a remote host in a non-secure fashion and without requiring user credentials?

Trivial File Transfer Protocol (TFTP) is used to transfer with a remote host in a non-secure fashion, and without requiring user credentials. However, File Transfer Protocol (FTP) typically does, however, require users to log in. Secure Shell (SSH) is used to securely connect to a remote host, typically via a terminal emulator. Secure FTP (SFTP) provides FTP file transfer service over a Secure Shell (SSH) connection. Secure Copy (SCP) provides a secure file transfer service over a SSH connection and offers a file's original data and time information, which is not available with FTP.

You have several computers in your network that are located behind a firewall. The computers are unable to obtain a dynamic IP address from the DHCP server. You suspect that the firewall is configured to block the DHCP traffic. Which port must be open on the firewall to allow the traffic?

UDP port 67. Dynamic Host Configuration Protocol (DHCP) transmits dynamic IP address assignment information over UDP port 67. DHCP is considered a connectionless protocol. IP addresses are assigned based on a series of messages between the client and the DHCP server. DHCP also uses port 68.

Which of the following is a connectionless transport layer protocol?

User Datagram Protocol (UDP) sacrifices reliability for speed and efficiency in the transport of data.

You administer your company's network, which is connected to the Internet. A firewall is configured between the company network and the Internet. You want to prevent users on the Internet from using HTTP to connect to computers on the company network. Which well-known TCP port should you block to prevent Internet users from entering the company's network on that port?

You should configure the firewall to block access to Transmission Control Protocol (TCP) port 80 in order to prevent Internet users from using HTTP to enter the company's network on that port. Because TCP port 80 is the well-known port number that is assigned to Hypertext Transfer Protocol (HTTP), configuring the firewall to block transmissions through port 80 will prevent HTTP communications from entering the network. Although well-known ports have been established as the standard ports for certain protocols, a protocol does not have to use the well-known port. For example, HTTP is often reconfigured to use port 8080.

You administer a TCP/IP network. You want to enable the hosts on your network to be automatically configured with IP configurations, such as IP address, subnet mask, and default gateway address. The IP configurations should be leased to the clients for a limited time. Which protocol should you use to accomplish this task?

You should use Dynamic Host Configuration Protocol (DHCP) to automatically configure the hosts on your network with IP configurations. DHCP was designed to automatically configure frequently moved, fully boot-capable computers, such as laptop computers, with IP configurations. You can use DHCP to configure such IP settings as IP address, subnet mask, and default gateway address. Typically, DHCP information is leased to a client for a limited period. DHCP clients usually release DHCP information when they are shut down. When a DHCP client retrieves IP configurations from a DHCP server, the DHCP client is not necessarily configured with the same IP configurations as on previous occasions.