Domain 1.4: Explain common networking ports, protocols, services, and traffic types Flashcards
(42 cards)
Question: Which protocol is commonly used to transfer files between computers on a network and operates on port 21?
Answer Options:
A. HTTP
B. FTP
C. SSH
D. Telnet
Correct Answer + Explanation:
FTP (File Transfer Protocol) is used to transfer files and operates on port 21.
Practical Use:
Web developers use FTP to upload files to web servers.
Why Others Are Incorrect:
A: HTTP is used for web traffic on port 80.
C: SSH is used for secure remote access on port 22.
D: Telnet is used for unencrypted remote access on port 23.
Exam Objective Reference:
Domain 1.4: Networking Protocols - FTP.
Follow-Up:
What is the difference between FTP and SFTP?
Question: Which protocol ensures secure communication over the internet and operates on port 443?
Answer Options:
A. HTTP
B. HTTPS
C. FTP
D. SMTP
Correct Answer + Explanation:
HTTPS (Hypertext Transfer Protocol Secure) ensures secure communication by encrypting data using SSL/TLS and operates on port 443.
Practical Use:
Websites use HTTPS to secure user data, such as login credentials and payment information.
Why Others Are Incorrect:
A: HTTP is unencrypted and operates on port 80.
C: FTP is used for file transfers on port 21.
D: SMTP is for sending emails on port 25.
Exam Objective Reference:
Domain 1.4: Networking Protocols - HTTPS.
Follow-Up:
What role does SSL/TLS play in HTTPS?
Question: Which protocol is used for sending email and typically operates on port 25?
Answer Options:
A. POP3
B. IMAP
C. SMTP
D. SNMP
Correct Answer + Explanation:
SMTP (Simple Mail Transfer Protocol) is used to send email and operates on port 25 by default.
Practical Use:
Email servers use SMTP to send messages between mail servers.
Why Others Are Incorrect:
A: POP3 retrieves email from mail servers on port 110.
B: IMAP retrieves email and synchronizes mailboxes on port 143.
D: SNMP is used for network management on port 161.
Exam Objective Reference:
Domain 1.4: Networking Protocols - SMTP.
Follow-Up:
What alternative port is commonly used for SMTP when encryption is required?
Question: What is the primary purpose of the DNS protocol, which operates on port 53?
Answer Options:
A. Transferring files between devices
B. Translating domain names to IP addresses
C. Monitoring network devices
D. Synchronizing clocks on a network
Correct Answer + Explanation:
DNS (Domain Name System) translates human-readable domain names into IP addresses and operates on port 53.
Practical Use:
When a user types “google.com,” DNS resolves it to the corresponding IP address.
Why Others Are Incorrect:
A: File transfers use protocols like FTP or SMB.
C: Monitoring uses SNMP.
D: Clock synchronization uses NTP.
Exam Objective Reference:
Domain 1.4: Networking Protocols - DNS.
Follow-Up:
What are the differences between recursive and iterative DNS queries?
Question: Which protocol provides secure remote access to network devices and operates on port 22?
Answer Options:
A. Telnet
B. FTP
C. SSH
D. HTTP
Correct Answer + Explanation:
SSH (Secure Shell) provides secure remote access by encrypting communications and operates on port 22.
Practical Use:
Network administrators use SSH to manage servers remotely.
Why Others Are Incorrect:
A: Telnet provides unencrypted remote access on port 23.
B: FTP is used for file transfers on port 21.
D: HTTP is used for web traffic on port 80.
Exam Objective Reference:
Domain 1.4: Networking Protocols - SSH.
Follow-Up:
What is the advantage of SSH over Telnet?
Question: Which protocol operates on port 69 and is commonly used for transferring small configuration files?
Answer Options:
A. FTP
B. TFTP
C. HTTP
D. IMAP
Correct Answer + Explanation:
TFTP (Trivial File Transfer Protocol) operates on port 69 and is used for transferring small configuration files without authentication.
Practical Use:
TFTP is often used to upload firmware to devices like routers or switches.
Why Others Are Incorrect:
A: FTP provides authenticated file transfer on port 21.
C: HTTP transfers web data on port 80.
D: IMAP retrieves email on port 143.
Exam Objective Reference:
Domain 1.4: Networking Protocols - TFTP.
Follow-Up:
Why is TFTP considered less secure than FTP?
Question: Which protocol uses port 3389 for remote desktop connections?
Answer Options:
A. SSH
B. RDP
C. Telnet
D. SNMP
Correct Answer + Explanation:
RDP (Remote Desktop Protocol) uses port 3389 to enable remote access to a computer’s desktop interface.
Practical Use:
IT professionals use RDP to troubleshoot issues on remote systems.
Why Others Are Incorrect:
A: SSH provides command-line remote access on port 22.
C: Telnet provides unencrypted remote access on port 23.
D: SNMP is used for monitoring devices on port 161.
Exam Objective Reference:
Domain 1.4: Networking Protocols - RDP.
Follow-Up:
What security concerns exist when using RDP without proper safeguards?
Question: Which protocol is responsible for synchronizing clocks on devices within a network?
Answer Options:
A. SNMP
B. FTP
C. NTP
D. SMTP
Correct Answer + Explanation:
NTP (Network Time Protocol) synchronizes clocks on devices within a network to ensure consistent timestamps and operates on port 123.
Practical Use:
NTP is critical for timestamp accuracy in logging and time-sensitive applications.
Why Others Are Incorrect:
A: SNMP monitors network devices on port 161.
B: FTP transfers files on port 21.
D: SMTP sends emails on port 25.
Exam Objective Reference:
Domain 1.4: Networking Protocols - NTP.
Follow-Up:
What challenges arise when NTP servers are out of sync?
Question: Which protocol is used for network device monitoring and operates on port 161?
Answer Options:
A. SSH
B. SNMP
C. RDP
D. TFTP
Correct Answer + Explanation:
SNMP (Simple Network Management Protocol) operates on port 161 and is used for monitoring and managing network devices.
Practical Use:
Network administrators use SNMP to track device health and performance.
Why Others Are Incorrect:
A: SSH provides secure remote access on port 22.
C: RDP provides remote desktop access on port 3389.
D: TFTP transfers files on port 69.
Exam Objective Reference:
Domain 1.4: Networking Protocols - SNMP.
Follow-Up:
What are the differences between SNMP versions 2 and 3?
Question: Which protocol is used to retrieve email from a mail server and operates on port 110?
Answer Options:
A. SMTP
B. IMAP
C. POP3
D. SNMP
Correct Answer + Explanation:
POP3 (Post Office Protocol v3) retrieves email from a mail server and operates on port 110.
Practical Use:
POP3 downloads emails to a client and removes them from the server.
Why Others Are Incorrect:
A: SMTP sends emails on port 25.
B: IMAP retrieves email but allows synchronization on port 143.
D: SNMP monitors network devices on port 161.
Exam Objective Reference:
Domain 1.4: Networking Protocols - POP3.
Follow-Up:
How does POP3 differ from IMAP in handling emails?
Question: A network administrator needs to securely transfer large files between systems over the internet. Which protocol and port should they use?
Answer Options:
A. FTP over port 21
B. SFTP over port 22
C. TFTP over port 69
D. SCP over port 443
Correct Answer + Explanation:
SFTP (Secure File Transfer Protocol) over port 22 should be used as it encrypts data during transfer, ensuring security.
Practical Use:
Administrators use SFTP to securely transfer configuration files or backups over the internet.
Why Others Are Incorrect:
A: FTP is not secure because it transfers data in plaintext.
C: TFTP is insecure and lacks authentication.
D: SCP uses port 22, not 443, and is for simple file transfers.
Exam Objective Reference:
Domain 1.4: Networking Protocols - SFTP.
Follow-Up:
What are the key differences between SFTP and SCP?
Question: A user reports that they cannot access a website via HTTPS. Which ports should be checked to ensure proper functionality?
Answer Options:
A. Port 21 and 443
B. Port 443 and 80
C. Port 110 and 25
D. Port 53 and 123
Correct Answer + Explanation:
Ports 443 (HTTPS) and 80 (HTTP) should be checked, as HTTPS requires port 443 and fallback HTTP traffic uses port 80.
Practical Use:
If port 443 is blocked, users may experience issues accessing secure websites.
Why Others Are Incorrect:
A: Port 21 is used for FTP.
C: Ports 110 and 25 are for email protocols.
D: Ports 53 and 123 are for DNS and NTP, respectively.
Exam Objective Reference:
Domain 1.4: Networking Protocols - HTTPS.
Follow-Up:
What tools can be used to test port connectivity for HTTPS?
Question: What traffic type does ICMP handle, and why is it crucial for network troubleshooting?
Answer Options:
A. TCP traffic for reliable communication
B. Error messages and diagnostics
C. Encryption for secure communication
D. File transfer requests
Correct Answer + Explanation:
ICMP (Internet Control Message Protocol) handles error messages and diagnostics, such as unreachable hosts or echo requests (ping).
Practical Use:
ICMP is used in tools like ping and traceroute to diagnose network connectivity issues.
Why Others Are Incorrect:
A: TCP handles reliable communication, not diagnostics.
C: ICMP does not provide encryption.
D: File transfers are managed by protocols like FTP.
Exam Objective Reference:
Domain 1.4: Networking Protocols - ICMP.
Follow-Up:
What are common ICMP-related issues that can occur in firewalls?
Question: Which email protocol allows synchronization across multiple devices and operates on port 143?
Answer Options:
A. POP3
B. SMTP
C. IMAP
D. SNMP
Correct Answer + Explanation:
IMAP (Internet Message Access Protocol) synchronizes emails across devices and operates on port 143.
Practical Use:
Users with multiple devices, like smartphones and laptops, rely on IMAP to maintain a consistent email view.
Why Others Are Incorrect:
A: POP3 downloads and deletes emails from the server.
B: SMTP is used for sending emails.
D: SNMP monitors network devices.
Exam Objective Reference:
Domain 1.4: Networking Protocols - IMAP.
Follow-Up:
How does IMAP’s functionality improve over POP3 for modern email usage?
Question: Which protocol and port should be configured to allow secure shell access to a remote Linux server?
Answer Options:
A. Telnet on port 23
B. SSH on port 22
C. RDP on port 3389
D. FTP on port 21
Correct Answer + Explanation:
SSH (Secure Shell) on port 22 should be configured to allow encrypted remote access to Linux servers.
Practical Use:
SSH ensures secure management of servers, protecting credentials and commands from interception.
Why Others Are Incorrect:
A: Telnet provides unencrypted access, posing security risks.
C: RDP is for graphical remote access to Windows systems.
D: FTP is for file transfers, not shell access.
Exam Objective Reference:
Domain 1.4: Networking Protocols - SSH.
Follow-Up:
What security risks does SSH mitigate compared to Telnet?
Question: A user experiences delays in sending emails. Upon investigation, which port should be checked to troubleshoot SMTP traffic?
Answer Options:
A. Port 25
B. Port 443
C. Port 110
D. Port 53
Correct Answer + Explanation:
Port 25 should be checked, as it is the default port for SMTP traffic used for sending emails.
Practical Use:
Network administrators monitor port 25 to identify email delivery bottlenecks or blockages.
Why Others Are Incorrect:
B: Port 443 is used for HTTPS.
C: Port 110 is for POP3.
D: Port 53 is used for DNS.
Exam Objective Reference:
Domain 1.4: Networking Protocols - SMTP.
Follow-Up:
What are alternative ports commonly used for encrypted SMTP traffic?
Question: Which protocol is used to monitor network devices and operates on port 161?
Answer Options:
A. SNMP
B. ICMP
C. NTP
D. Telnet
Correct Answer + Explanation:
SNMP (Simple Network Management Protocol) is used to monitor and manage network devices and operates on port 161.
Practical Use:
Network administrators use SNMP to track performance metrics and identify potential hardware failures.
Why Others Are Incorrect:
B: ICMP is used for diagnostics, not monitoring.
C: NTP synchronizes time across devices.
D: Telnet provides unencrypted remote access.
Exam Objective Reference:
Domain 1.4: Networking Protocols - SNMP.
Follow-Up:
What is the significance of SNMP traps in proactive network monitoring?
Question: Which protocol and port enable domain name resolution in a network?
Answer Options:
A. DHCP on port 67
B. DNS on port 53
C. NTP on port 123
D. RDP on port 3389
Correct Answer + Explanation:
DNS (Domain Name System) on port 53 enables the resolution of domain names into IP addresses.
Practical Use:
DNS allows users to access websites like “example.com” without needing to remember IP addresses.
Why Others Are Incorrect:
A: DHCP assigns IP addresses dynamically.
C: NTP synchronizes clocks.
D: RDP provides remote desktop access.
Exam Objective Reference:
Domain 1.4: Networking Protocols - DNS.
Follow-Up:
How do DNS records like A, MX, and CNAME function within a DNS query?
Question: A critical web application must use HTTPS for secure communication. How does HTTPS ensure data integrity and confidentiality?
Answer Options:
A. By encrypting traffic using SSL/TLS
B. By authenticating client IP addresses
C. By using symmetric key encryption only
D. By masking the server’s IP address
Correct Answer + Explanation:
HTTPS encrypts traffic using SSL/TLS, ensuring data integrity and confidentiality between the client and server.
Practical Use:
HTTPS prevents attackers from intercepting or altering data transmitted between users and web applications.
Why Others Are Incorrect:
B: HTTPS uses certificates, not IP authentication.
C: SSL/TLS uses both symmetric and asymmetric encryption.
D: HTTPS does not hide server IPs; it encrypts traffic.
Exam Objective Reference:
Domain 1.4: Networking Protocols - HTTPS.
Follow-Up:
What role do digital certificates play in HTTPS security?
Question: A network engineer needs to configure an access control list (ACL) to block all Telnet traffic. Which port should be specified in the ACL?
Answer Options:
A. Port 21
B. Port 22
C. Port 23
D. Port 69
Correct Answer + Explanation:
Port 23 should be specified, as it is used for Telnet traffic, which is typically blocked due to security risks.
Practical Use:
Blocking port 23 ensures unencrypted Telnet sessions cannot compromise network security.
Why Others Are Incorrect:
A: Port 21 is for FTP.
B: Port 22 is for SSH.
D: Port 69 is for TFTP.
Exam Objective Reference:
Domain 1.4: Networking Protocols - Telnet.
Follow-Up:
What are secure alternatives to Telnet for managing network devices?
Question: A security team monitors a network for unauthorized data exfiltration using DNS tunneling. Which aspect of DNS traffic should be analyzed to detect such activities?
Answer Options:
A. DNS query response times
B. Length and frequency of DNS queries
C. TTL values of DNS records
D. Cache hit rates for DNS resolutions
Correct Answer + Explanation:
Length and frequency of DNS queries are critical indicators of DNS tunneling, as attackers often use unusually long queries or repeated requests to exfiltrate data.
Practical Use:
DNS tunneling detection tools analyze query patterns and flag suspicious activities for further investigation.
Why Others Are Incorrect:
A: Query response times are less relevant for detecting tunneling.
C: TTL values pertain to caching and are not direct indicators of tunneling.
D: Cache hit rates are unrelated to exfiltration detection.
Exam Objective Reference:
Domain 1.4: Networking Traffic Types - DNS.
Follow-Up:
What mitigation techniques can prevent DNS tunneling attacks?
Question: A video streaming service is experiencing buffering issues. Which protocol and port are most likely relevant to troubleshoot real-time streaming?
Answer Options:
A. HTTP on port 80
B. RTP on port 5004
C. SMTP on port 25
D. FTP on port 21
Correct Answer + Explanation:
RTP (Real-time Transport Protocol) on port 5004 is used for real-time audio and video streaming, making it relevant for troubleshooting buffering issues.
Practical Use:
Video conferencing tools and streaming services rely on RTP for low-latency data transmission.
Why Others Are Incorrect:
A: HTTP is for web traffic and not optimized for real-time streaming.
C: SMTP is for email.
D: FTP is for file transfers.
Exam Objective Reference:
Domain 1.4: Networking Protocols - RTP.
Follow-Up:
What role does RTCP play in ensuring the quality of RTP streams?
Question: A company deploys an SNMPv3-enabled device to improve security. What distinguishes SNMPv3 from earlier versions?
Answer Options:
A. Support for IPv6
B. Encryption and authentication features
C. Increased device compatibility
D. Faster polling intervals
Correct Answer + Explanation:
SNMPv3 includes encryption and authentication features, enhancing security compared to earlier versions like SNMPv1 and SNMPv2.
Practical Use:
Network administrators use SNMPv3 to securely monitor device performance and configuration.
Why Others Are Incorrect:
A: IPv6 support is not exclusive to SNMPv3.
C: Compatibility depends on device implementation, not protocol version.
D: Polling intervals are configurable and not tied to protocol versions.
Exam Objective Reference:
Domain 1.4: Networking Protocols - SNMP.
Follow-Up:
What are the trade-offs of enabling encryption in SNMPv3?
Question: A network engineer is troubleshooting intermittent packet loss during VoIP calls. Which protocol and port should be analyzed to identify the issue?
Answer Options:
A. RTP on port 5004
B. SIP on port 5060
C. H.323 on port 1720
D. HTTPS on port 443
Correct Answer + Explanation:
RTP (Real-time Transport Protocol) on port 5004 carries the actual voice data, and packet loss directly impacts call quality.
Practical Use:
Analyzing RTP traffic can reveal jitter, latency, or loss affecting VoIP performance.
Why Others Are Incorrect:
B: SIP handles call signaling, not voice data.
C: H.323 is a signaling protocol similar to SIP.
D: HTTPS is unrelated to VoIP traffic.
Exam Objective Reference:
Domain 1.4: Networking Traffic Types - RTP.
Follow-Up:
What tools can be used to measure RTP packet loss and jitter?