Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CCNA Cyber Ops 210-250 > Chapter 1: Networking Protocols > Flashcards

Chapter 1: Networking Protocols Flashcards

(151 cards)

Start Studying
1
Q

What are the four layers of the TCP/IP model?

A
  • Application
  • Transport
  • Internet (Networking)
  • Link
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the two layers of the Link layer?

A
  • Data Link

- Physical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Link Layer

A
  • provides physical transmission support and includes the protocols used to transmit information over a link between two devices
  • frames
  • includes hardware and protocol necessary to send information between two hosts that are connected by a physical link (cable) or over the air (radio waves)
  • Most popular protocol is Ethernet
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Internet Layer

A
  • aka Networking
  • provides networking services and includes protocols that allow for the transmission of information through multiple hops
  • each “hop device” knows how to reach the destination IP address and transmit the information to the next best node to reach the destination
  • Packets
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Routing Protocol

A
  • the way each node (router) determines the best next node to the destination
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Transport Layer

A
  • when transmitting information, the sending host knows when the information is sent, but has no way to know whether it actually made it to the destination
  • so, Transport Layer provides services to successfully transfer information between two end-to-end process
  • detects whether any information went missing
  • provides information about which type of information is being transmitted
  • Segments
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

How does the Transport Layer distinguish between separate transactions, such as requesting a web page and starting an FTP transaction?

A
  • the Transport Layer helps to separate the two requests by using the concept of a Transport Layer PORT
  • port 80 for web request
  • port 21 for an FTP transaction
  • this service is called MULTIPLEXING
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Application Layer

A
  • top layer and most familiar to end users
  • ## a user may use the mail client to send an email message (SMTP), or use a web browser to browse a website (HTTP)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

TCP/IP Model Encapsulation

A
  • each layer provides services for the level above it
  • protocols at each layer include a protocol header
  • the header includes enough information for the protocol to work toward the delivery of the information
  • this process is called ENCAPSULATION
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

DNS Resolution

A

Step 1: Host A sends a recursive DNS query for a type A record to resolve www.cisco.com to its own DNS server (DNS A)
Step 2: DNS A server checks its DNS cache, but does not find the information. So, it sends an iterative DNS query to the root DNS server, which is authoritative for all of the Internet
Step 3: The root DNS server is not authoritative for that host, so it sends back a referral to the .com DNS server, which is authoritative server for the .com domain.
Step 4: The .com DNS server performs a similar process and sends a referral to the cisco.com DNS server
Step 5: The cisco.com DNS server is the DNS authoritative server for www.cisco.com so it can reply to DNS A with the information
Step 6: DNS A receives the information and stores it in its DNS cache for future use.
Step 7: Host A receives the information from DNS A and can start sending packets to www.cisco.com using the correct IP address.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

How long does a DNS server store information in its cache?

A
  • finite time based on the TTL value in the response from the authoritative DNS server for a given doamin
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

TCP

A
  • Transmission Control Protocol
  • reliable, connection-oriented protocol for communicating over the Internet
  • Connection-oriented means that TCP requires a connection between two hosts established through a specific packet exchange before any data packets can be sent
  • —-Services provided——
  • multiplexing
  • connection establishment and termination
  • reliability (error detection and recovery)
  • flow control
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Why not use TCP for all applications?

A
  • the reliability offered by TCP is done at the cost of lower speed and the need for increased bandwidth
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Multiplexing

A
  • allows multiple transport layer connections between the same hosts
  • sockets are used to distinguish to which application a connection belongs
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Connection Establishment and Termination

A
  • a connection is established before data is sent
  • this ensures that the other host is ready to receive data
  • the connection is also terminated through a formal data exchange
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Reliability

A
  • data lost due to error or from the underlying datagram can be recovered by asking the remote device to send the information again
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Flow Control

A
  • TCP uses a windowing system to adjust the speed of transmission
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

TCP Header Fields

A
  • Source and Destination Ports
  • Sequence Number
  • Acknowledgment Number
  • Control Flags
  • Window
  • Urgent Pointer
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

TCP Flags

A
  • URG
  • ACK
  • PSH
  • RST
  • SYN
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

ACK

A
  • Acknowledgement flag

- Set to 1 after the connection has been established

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

PSH

A
  • Push flag

- signifies that the data should be pushed directly to an application

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

RST

A
  • Reset flag

- Resets the connection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

SYN

A
  • Synchronization
  • sequence numbers
  • relevant for connection establishment
  • should only be set within the first packets from both of the hosts
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

FIN

A
  • this flag signifies that there is no more data from sender
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Window
- this field indicates the number of data bytes the sender of the segment is able to receive - this field enables flow control
26
TCP Three-way Handshake
- First Packet (SYN): the client starts process of establishing a connection by sending a TCP segment that has the SYN bit set to 1. The client sends its initial sequence number X (random number chosen by client) - Second Packet (SYN-ACK): the server responds with a SYN-ACK packet where it sends its own request for synchronization and its initial sequence number Y. Within the same packet, the server also sends the acknowledgment number X+1 (acknowledging the receipt of a packet with sequence number X, and requesting the next packet with sequence number X+1) - Third Packet (ACK): the client responds with a final acknowledgment, requesting the next packet with the sequence number Y+1
27
What is the purpose of SYN from sender
- signals to the peer that it wants to synchronize the sequence numbers and establish the connection - the client also sends its initial sequence number, which is random number chosen by the client
28
What are the steps of TCP/IP Model Encapsulation for a host requesting a web page using HTTP?
1. Host requests a web page using the HTTP application layer protocol. The HTTP application generates the DATA payload. 2. HTTP DATA payload send to the transport layer and a TCP header is created. The DATA payload and TCP header result in the TCP segment. 3. The Internet layer receives the TCP information, attaches an IP header, and encapsulates it in an IP Packet. 4. The IP packet is passed to the Data Link layer. An Ethernet header and trailer, and then transmits the Frame to the NIC, which will take care of the physical transmission of the frame.
29
IEEE 802.2
- Standard for LLC (Logical Link Control)
30
IEEE 802.3
- Standard for Ethernet Medium Access Control (MAC)
31
LLC
- Logical Link Control - Initially used to allow several types of Layer 3 protocols to work with the MAC - However, LLC is seldom used now because IP can be directly encapsulated using MAC.
32
What is the nomenclauture format for Ethernet Physical Layer standards?
- sTYPE-M - s = speed - TYPE = the modulation type (example, BASE = baseband) - M = medium (example, T = twisted pair, F = fiber, L = long wavelength, X = external sourced coding)
33
100BASE-T
- standard = 802.3 (Ethernet) - speed = 10 Mbps - media = twisted pair (copper) - distance = 100 m
34
100BASE-T
- standard = 802.3u (FastEthernet) - speed = 100 Mbps - media = twisted pair (copper) - distance = 100 m
35
1000BASE-T
- standard = 802.3ab (GigaEthernet) - speed = 1000 Mbps - media = twisted pair (copper) - distance = 100 m
36
1000BASE-LX
- standard = 802.3z (GigaEthernet) - speed = 1000 Mbps - media = Long wavelength (single-mode fiber) - distance = 5 km
37
10GBASE-T
- standard = 802.3an (Gigabit Ethernet) - speed = 10 GBps - media = twisted pair (copper) - distance = 100 m
38
What is the speed of Ethernet?
- 10 Mbps
39
What is the speed of FastEthernet?
- 100 Mbps
40
What is the speed of GigaEthernet?
- 1000 Mbps
41
What are the two modes of medium access with Ethernet MAC?
- half duplex | - full duplex
42
Half Duplex
- two Ethernet devices share a common transmission medium - access is controlled by Carrier Sense Multiple Access with Collision Detection (CSMA/CD) - if a collision occurs, stations delay transmission set by the "backoff time" - half duplex is rarely seen today
43
Full duplex
- two Ethernet devices can share simultaneously because there is a dedicated channel for the transmission - no need to detect collisions or waiting before transmitting - "collision free" medium access
44
What is an example of a device that uses Full Duplex?
- Switch | - provides a collision-free domain and dedicated transmission channel
45
What are the components of an Ethernet frame?
- Preamble - Start Frame Delimiter - Destination Address - Source Address - Length/Type - MAC Client Data and Pad - Frame Check Sequence
46
Preamble
- used for the two stations for synchronization purposes
47
SFD
- Start Frame Delimiter - Indicates the start of the Ethernet frame - Always set to 10101011
48
MAC Client Data and Pad
- contains information being encapsulated at the Ethernet layer - Minimum length is 46 bytes - Maximum length depends on the type of Ethernet Frame: - - Basic frames (most common) = 1500 bytes - - Q-tagged frames = 1504 bytes - - Envelope frames = 1982
49
FCS
- Frame Check Sequence - used by the receiving device to check for errors in transmission - called the "Ethernet Trailer"
50
What are the three types of MAC addresses?
- broadcast - multicast - unicast
51
Broadcast MAC address
- obtained by setting all 1s in the MAC address field - the result is an address like FFFF.FFFF.FFFF - a frame with a broadcast destination address is transmitted to all the devices within a LAN
52
Multicast MAC address
- transmitted to all frames belonging to a specific group
53
Unicast MAC address
- associated with a particular device's NIC or port - composed of two sections: - - first 24 bits = OUI (Organizational Unique Identifier) - - second 24 bits = Vendor assigned
54
Broadcast Storm
- when a frame loops between switches indefinitely, causing degradation of the network performance due to the useless forwarding of frames - prevented by using STP (Spanning Tree Protocols)
55
STP
- Spanning Tree Protocols - used to avoid layer 2 loops - this is done by allowing traffic on certain ports and blocking it on others - if the topology changes, (i.e. a link fails) STP will recalculate the new logical topology (aka "reconverge") and unblock certain ports to adapt to the new topology
56
Reconvergence
- When STP detects a change in topology (i.e. a link failure) and recalculate the new logical topology to unblock certain ports in order to adapt to the new topology
57
STA
- Spanning Tree Algorithm used by STP to create a tree-like, loop-free logical topology
58
BID
- Bridge ID - 8-byte ID that is independently calculated on each switch - the first 2-bytes contain the priority - the remaining 6-bytes include the MAC address of the switch
59
Root Switch
- represents the root of the spanning tree - determined through "root election" - the root switch BID is called the "root BID"
60
Port Cost
- numerical value associated to each spanning tree port - usually this value depends on the speed of the port - the higher the speed the lower the cost
61
Root Cost
- represents the cost to reach the root switch
62
What are the different port states?
- Blocking - Listening - Learning - Forwarding - Disabled
63
What are the benefits of Vlans?
- Reduces the number of devices receiving the broadcast frame and the related overhead - Creates Layer 2 network separation - Reduces management protocols' load and complexity - Segments troubleshooting and failure areas, as failure in one VLAN will not propagate to the rest of the network
64
Trunking
- Placing two hosts on separate Switches in the same VLAN - It is a special link because it can transport frames belonging to several VLANs - VLAN tagging is used to enable the forwarding between hosts in the same VLAN, across multiple switches - This is done using dot1q standard (IEEE 802.1Q) or ISL (Inter-Switch Link)
65
What goes into the IEEE 802.1Q Tag?
- 4 Bytes - VLAN Protocol ID (16 bits) - Priority (3 bits) - CFO (1 bit) - VLAN ID (12 bits)
66
VTP
- VLAN Trunking Protocol - Cisco proprietary protocol used to manage VLAN distribution across switches - Used to distributed information about existing VLANs to all switches in a VTP domain so that VLANs do not have to be manually configured (reducing admin burden) - Not to be confused with protocols that actually handle the tagging of frames with VLAN information (dot1Q) - VTP relies on 802.1Q to transmit information
67
What are the 3 modes of VTP?
- Server mode - Client mode - Transparent mode
68
Server Mode
- allows the administrator to configure a remote VLAN | - VTP will take care of distributing the information to other switches in the VTP domain
69
Client Mode
- a switch receives updates about a VLAN and advertises the VLAN configured already - however, a VLAN cannot be added or removed
70
Transparent Mode
- the switch does not participate in VTP, so it does not perform a VLAN database update and does not generate VTP advertisement - However, it forwards VTP advertisements from other switches
71
What devices map to the Session, Presentation, and Application layers?
- Hosts | - Servers
72
What devices map to the Transport layer?
- Stateful firewalls
73
What devices map to the Network layer?
- Router
74
What devices map to the Data Link layer?
- Switches
75
What devices map to the Physical layer?
- Repeater
76
802.11
- WLAN (Wireless Local Area Network) standard
77
What are several differences between WLAN and Ethernet?
- There is no defined boundary - It is more prone to interference by other signals on the same medium - It is less reliable - The signal can propagate in asymmetric ways
78
What duplex does WLAN use and why?
- half-duplex | - stations are not able to transmit and receive at the same time due to the limitation of the medium
79
Under the WLAN standard, how do stations determine if other stations are transmitting currently?
- CSMA/CD (Carrier Sense Media Access with Collision Avoidance)
80
What is the difference between CSMA/CD and CSMA/CA
- CSMA/CA does not allow WLAN stations to detect a collision
81
BSS
- Basic Service Set - Used by the IEEE 802.11 standard (WLAN) - identifies a set of devices that share common parameters and can communicate through a wireless connection.
82
What is the most common type of BSS?
- IBSS (Independent Basic Service Set) - formed by two or more wireless stations communicating directly. - sometimes called "ad-hoc wireless network"
83
Infrastructure BSS
- utilizes an AP (access point) - each station associates to an AP - stations send frames to the AP, and then the AP forwards the frame to the intended receiving station
84
Roaming
- releasing a client from one AP in order to associate to another AP
85
ESS
- Extended Service Set | - Multiple Infrastructure Basic Service Set APs linked together
86
802.11 Frame Components
- Frame Control - Duration Field - Address Fields - Sequence Control Field - Frame Body - Frame Check Sequence Field
87
Frame Control
- provides information on the frame type and whether the frame is directed toward the DS or is coming from the DS toward the wireless network
88
Duration Field
- provides the expected time the frame will be traveling on the channel for the Virtual Carrier Sense functionality
89
Address Fields
- Typically includes the following: - - Transmitter Address (TA): MAC of the sender - - Receiver Address (RA): MAC of the receiver - - Source Address (SA): MAC of the source - - Destination Address (DA): MAC of the destination
90
What are the types of APs?
- Autonomous APs: work in a standalone mode | - Lightweight APs: works with a Wireless LAN Controller (WLC)
91
What does the IP Routing table contain?
- the destination IP address | - next-hop IP address
92
IP Header Fields
- Version - Internet Header Length (20 bytes = standard) - Notification and Explicit Congestion ECN (Q of S) - Total Length (Header plus payload) - Identification (used for fragmentation) - Flags and Fragment offset (used for fragmentation) - TTL - Protocol (TCP = 6, UDP = 7) - Header checksum - Source Address - Destination Address
93
IPv4 Address Ranges: Class A
- 1.0.0.0 - 127.255.255.255
94
IPv4 Address Ranges: Class B
- 128.0.0.0 - 191.255.255.255
95
IPv4 Address Ranges: Class C
- 192.0.0.0 - 233.255.255.255
96
IPv4 Address Ranges: Class D
-224.0.0.0 - 239.255.255.255 (Multicast)
97
IPv4 Address Ranges: Class E
- 240.0.0.0 - 255.255.255.255 (Reserved)
98
How many network bits and how many host bits: - Class A - Class B - Class C
- Class A: 8 Network bits, 24 Host bits - Class B: 16 Network bits, 16 Host bits - Class C: 24 Network bits, 8 Host bits
99
What are the Private IP Address Ranges?
- 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16
100
What ports are used for DHCP?
- Port 67 = server | - Port 68 = client
101
DHCPDISCOVERY
- used by a client to discover DHCP servers w/in a LAN
102
DHCPOFFER
- sent by a DHCP server to a client - includes a proposed IP address, called YIADDR, and a network mask - aka SIADDR
103
DHCPREQUEST
- sent from the client to the broadcast network - used to confirm the offer from a particular server - includes the SIADDR of the DHCP server - broadcasted to the entire network
104
DHCPRELEASE
- sent from the client to the server to release the allocation of an IP address and to end the lease
105
What is the 4 step DHCP process
1. Host sends DHCPDISCOVERY packet to discover the DHCP servers within the LAN 2. Each DHCP server responds with DHCPOFFER message 3. The client receives several offers, picks one of them, and responds with a DHCPREQUEST 4. The DHCP server that has been selected responds to the client to confirm the leasing of the IP address
106
IGP
Interior Gateway Protocol (operates w/in organizational boundaries) - Open Shortest Path First (OSPF) - Intermediate System to Intermediate System (ISIS) - Enhanced Interior Gateway Routing Protocol (EIGRP) - Routing Information Protocol V.2 (RIPv2)
107
EGP
Exterior Gateway Protocol (operates between service providers) - Border Gateway Protocol (BGP)
108
DV
- Distance Vector - one of the first algorithms used for exchanging routing information - based on Bellman-Ford algorithm - most well-known is RIPv2
109
Neighbors
- Term used in DV | - two routers or Layer 3 devices that are directly connected
110
Hop Count
- Term used in DV | - number that represents the distance (number of routers) between a router and a specific network
111
What are some issues with using DV?
- Using hop count as the cost to determine the best path to a destination is not the best method - Routers do not have full visibility into the network topology - Each update includes the exchange of the full list of networks and costs, which can consume bandwidth - It is not loop free
112
How has Cisco overcome the shortcomings of DV?
- Introduced advanced distance vector, or hybrid protocols | - Such as EIGRP
113
What are the main enhancements of EIGRP over DV?
- they do not use hop counts as metrics to determine the best path to a network - full database updates are only sent at initialization - partial updates are sent in the event of topology changes - include more robust methods to prevent loops and reduce convergence times
114
What is an example of how EIGRP prevents loops and reduces convergence time?
- EIGRP routers maintain a partial topology table and include an algorithm called Diffused Update Algorithm (DUAL) which is used to calculate the best path to a destination and provides a mechanism to avoid loops
115
Link-State
- Link-state algorithms operate in a totally different way than DV - devices using Link-State have full view of the network topology - this allows devices to use algorithms such as Dijkstra or Shortest Path First (SPF) to calculate the best path to each network - examples include OSPF and IS-IS - Higher the bandwidth the lower the cost - During the initiation phase, each router will send a link-state advertisement (LSA) to neighbors, which will in turn forward to all other neighbors - Routers can then use SPF algorithm to calculate the best way to reach each network - Once this is done, the information is added to the router's routing table
116
What are advantages of a Link-State algorithm?
- a better way to calculate the cost to a destination - less protocol overhead compared to DV because updates do not require sending the full topology - better best-path calculation because each router has a full view of the full topology - loop-free
117
Administrative Distance
- used to determine the precedence based on the way the router has learned about a specific network
118
Cisco Default Administrative Distances: Connected Interface
0
119
Cisco Default Administrative Distances: Static Route
1
120
Cisco Default Administrative Distances: EIGRP (summary routes)
5
121
Cisco Default Administrative Distances: External BGP
20
122
Cisco Default Administrative Distances: Internal EIGRP
90
123
Cisco Default Administrative Distances: IGRP
100
124
Cisco Default Administrative Distances: OSPF
110
125
Cisco Default Administrative Distances: IS-IS
115
126
Cisco Default Administrative Distances: RIP
120
127
Cisco Default Administrative Distances: EGP
- Exterior Gateway Protocol | - 140
128
Cisco Default Administrative Distances: ODR
- On Demand Routing | - 160
129
Cisco Default Administrative Distances: External EIGRP
170
130
Cisco Default Administrative Distances: Internal BGP
200
131
Cisco Default Administrative Distances: Unknown
255
132
ICMP
- Internet Control Message Protocol - main purpose is to provide a way to communicate that an error occurred during the routing of IP packets - encapsulated directly within the IP payload - An IP packet transporting an ICMP message in its payload sets the Protocol field in the header to 1 - An ICMP packet starts with an ICMP header that always includes the Type and Code fields of the ICMP message, which define what the message is used for
133
What is ICMP Type 0
- Echo Reply
134
What is ICMP Type 3
Destination Unreachable
135
What is ICMP Type 3 - Code 0
Network Unreachable
136
What is ICMP Type 3 - Code 1
Host Unreachable
137
What is ICMP Type 3 - Code 2
Protocol Unreachable
138
What is ICMP Type 3 - Code 3
Port Unreachable
139
What is ICMP Type 3 - Code 4
Fragmentation Required, and DF flag set
140
What is ICMP Type 8
Echo Request
141
What is ICMP Type 11
Time Exceeded
142
What is ICMP Type 11 - Code 0
TTL Exceed in transit
143
What is ICMP Type 11 - Code 1
Fragment reassembly time exceeded
144
What are the components of a domain name?
- Root (.) - Top-level domain (.com) - Second-level domain (cisco) - Subdomains (eg. tools) - Resource name (hostname of the resource, www)
145
Common DNS Resource Records: A
- Address record IPv4 | - Mapping between IPv4 and FQDN
146
Common DNS Resource Records: AAAA
- Address record IPv6 | - Mapping between IPv6 and FQDN
147
Common DNS Resource Records: MX
- Mail Exchange Record | - Includes information about mail exchange servers in a domain
148
Common DNS Resource Records: NS
- Name Server Record | - Indicates the authoritative servers for a DNS zone
149
Common DNS Resource Records: SOA
- Start of Authority Record | - Includes information about the zone, such as the authoritative name server for that zone
150
DNS Zones
- DNS databases are divided into Zones - A Zone is a portion of the DNS database that is managed by an entity - Each zone must have an SOA RR that includes information about the management of the zone and the primary authoritative name server - Each DNS Zone must have an authoritative name server
151
DNS Authoritative Server
- the server that has the information about the resources present in the DNS zone and can respond to queries concerning those resources

CCNA Cyber Ops 210-250 (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions