AP Networking OSI and Encapsulation Practice Test

1. A lease extension for the destination
2. A permanent name for every byte
3. An unchanged frame reused on every path
4. Protocol information needed by successive processing layers

Correct answer: D. Protocol information needed by successive processing layers

Layers add information such as transport, network and link headers so the data can be handled by the appropriate peers and local links.

1. Changing only the host's address
2. Processing and removing relevant protocol wrapping to deliver the payload upward
3. Increasing the physical link capacity
4. Copying wrappers into DNS records

Correct answer: B. Processing and removing relevant protocol wrapping to deliver the payload upward

The receiver processes each applicable protocol wrapper and passes the remaining content toward the intended application.

1. A destination TCP port
2. A DNS query identifier
3. A MAC address
4. A destination IPv4 address alone

Correct answer: C. A MAC address

Ethernet addressing directs local link delivery. IP addresses and transport fields play different roles inside the carried packet.

1. DNS query type
2. Destination IPv4 address
3. TCP destination port
4. Ethernet destination MAC alone

Correct answer: B. Destination IPv4 address

The network-layer destination is distinct from the next-hop Ethernet destination. Routers use the packet destination and routing state to choose forwarding.

1. Ethernet FCS alone
2. Port numbers
3. VLAN identifiers alone
4. IPv4 TTL alone

Correct answer: B. Port numbers

TCP and UDP ports help identify transport endpoints. A complete flow also needs addresses, protocol and context.

1. Fragment offset
2. Protocol
3. TTL
4. Header checksum

Correct answer: B. Protocol

The IPv4 Protocol field indicates the next protocol, such as TCP. Other fields serve lifetime, integrity and fragmentation roles.

1. Address ownership verification
2. Application authorization
3. User authentication
4. Detection of frame corruption at the link level

Correct answer: D. Detection of frame corruption at the link level

The frame check sequence detects many transmission errors. It does not authenticate ownership or decide application permission.

1. FCS guarantees every inner checksum is valid
2. Error detection is different from identity, authorization and application meaning
3. FCS proves the requested action was allowed
4. FCS proves authenticated source ownership

Correct answer: B. Error detection is different from identity, authorization and application meaning

Frame integrity has a limited purpose. A correctly transmitted frame can still contain unauthorized or invalid application content.

1. Network layer
2. Application
3. Data link
4. Transport

Correct answer: A. Network layer

Routing is a network-layer function in the conceptual model. Real implementations can combine several functions in one device.

1. Physical layer
2. Transport
3. Data link
4. Network

Correct answer: A. Physical layer

The physical layer concerns transmission of signals. Higher layers interpret structured frames, packets and application exchanges.

1. Application
2. Network
3. Transport
4. Data link layer

Correct answer: D. Data link layer

Ethernet framing is a data-link function. Its local forwarding identity is different from end-to-end IP addressing.

1. Yes, it cannot host a management protocol
2. Yes, it cannot inspect an Ethernet header
3. No, routing itself is only an application function
4. No; it can also process link, transport, management and other functions

Correct answer: D. No; it can also process link, transport, management and other functions

The model describes functions rather than forbidding multifunction devices. Identify the actual processing involved in the question.

1. Only the complete user file regardless of protocol
2. Only the physical medium
3. The structured unit handled by a particular protocol or layer
4. Only the transport port value

Correct answer: C. The structured unit handled by a particular protocol or layer

PDU terminology refers to data in its protocol context. Frame, packet and segment describe different wrapping levels.

1. Application payload
2. IPv4 header
3. Ethernet header
4. UDP header

Correct answer: C. Ethernet header

Outer link framing comes before the carried network packet and its transport payload. A capture may present metadata separately from actual wire fields.

1. The maximum number of clients
2. The maximum IP packet size supported without additional handling on that link
3. The largest downloadable object
4. The DNS answer lifetime

Correct answer: B. The maximum IP packet size supported without additional handling on that link

Large application data can span many packets. MTU concerns packet size on a particular link, not the total application object's size.

1. TCP sequence number
2. TTL
3. DNS record TTL
4. Ethernet destination

Correct answer: B. TTL

Routers decrement TTL during forwarding and discard packets when the required lifetime is exhausted. It is not a DNS cache TTL.

1. Yes, both govern connection duration
2. No; one limits packet lifetime and the other controls DNS cache freshness
3. Yes, both always describe cache freshness
4. Yes, both must share a numeric value

Correct answer: B. No; one limits packet lifetime and the other controls DNS cache freshness

The shared abbreviation does not imply the same mechanism. Keep packet and cached-record contexts separate.

1. No; transport and network processing can carry it across many units
2. Yes, the interface MTU must equal the object size
3. No, the application cannot use Ethernet at all
4. Yes, each TCP segment must contain the entire object

Correct answer: A. No; transport and network processing can carry it across many units

Application object size is independent of individual frame capacity. Segmentation and framing divide the transmitted data as appropriate.

1. Only the Ethernet source
2. The local address and port with protocol/socket context
3. Only the DNS zone serial
4. Only the packet's initial TTL

Correct answer: B. The local address and port with protocol/socket context

Transport demultiplexing uses endpoint information. A valid frame reaching the host still needs the appropriate receiving socket.

1. Yes, routers must decrypt every protected application
2. No; usable outer forwarding information can remain visible
3. Yes, all encrypted flows remove outer addressing
4. No, encryption cannot protect application content

Correct answer: B. No; usable outer forwarding information can remain visible

Encryption scope depends on the protocol. Outer addressing can remain visible while application content is protected.

1. An application authorization role automatically
2. A transport service port
3. The frame's VLAN context on that tagged link
4. An IPv4 lease timer

Correct answer: C. The frame's VLAN context on that tagged link

Tagging carries link-level VLAN context. It does not by itself identify application users or supply endpoint IP configuration.

1. Capture metadata necessarily changes remote forwarding
2. Every capture timestamp is a transmitted IP field
3. The capture tool may add timestamps or interface information that was not transmitted in the packet
4. Every interface label is part of the payload

Correct answer: C. The capture tool may add timestamps or interface information that was not transmitted in the packet

Capture records include collection context. Do not treat that context as automatically present in the wire protocol.

1. Four copies sent over separate physical paths
2. Four address allocations
3. Successive wrappers and payload interpretation for that observed exchange
4. Four unrelated messages with no containment

Correct answer: C. Successive wrappers and payload interpretation for that observed exchange

A decoder presents layers of the packet and application interpretation. Validate context before assuming every application stream is fully reconstructed.

1. A completed ARP exchange only
2. A correctly learned switch MAC only
3. A local link indication
4. Confirming the requested operation returned the intended result

Correct answer: D. Confirming the requested operation returned the intended result

Lower-layer prerequisites support delivery. The intended application task requires a result at the application level.

1. Different protocols address different delivery or processing scopes
2. All identifiers must be duplicates of the IP destination
3. Several identifiers prove corruption
4. Only one protocol's destination can be valid

Correct answer: A. Different protocols address different delivery or processing scopes

MAC, IP and transport endpoints describe different scopes. Read each field within its own protocol boundary.

1. The resolver MAC regardless of selected route
2. A's own MAC as destination
3. B's remote NIC MAC on every routed link
4. R's local ingress-side next-hop MAC

Correct answer: D. R's local ingress-side next-hop MAC

The first link delivers the packet to the local router. The final host MAC is used only on the relevant destination-side link.

1. The new frame uses R's egress-side source MAC and the next hop's destination MAC
2. Replace the MAC destination with the remote hostname
3. Preserve both original Ethernet addresses on every routed hop
4. Use the source IPv4 address as the outgoing source MAC

Correct answer: A. The new frame uses R's egress-side source MAC and the next hop's destination MAC

Routing removes the incoming link wrapping and creates appropriate outgoing framing. End-to-end IP endpoints and per-link MAC endpoints are distinct.

1. 1
2. 3
3. 2
4. 0 while forwarding normally

Correct answer: A. 1

Ordinary forwarding reduces TTL by at least one. TTL 2 becomes 1 for that single-hop example.

1. Forward unchanged to avoid losing the packet
2. Reset TTL to 255
3. Treat the expired packet as a successful destination response
4. The router discards it and can return ICMP Time Exceeded subject to applicable rules

Correct answer: D. The router discards it and can return ICMP Time Exceeded subject to applicable rules

TTL exhaustion prevents continuing routing loops. ICMP generation has relevant restrictions, so a missing message is not proof that forwarding occurred.

1. The IPv4 header checksum
2. DNS TTL
3. TCP sequence number
4. DHCP transaction ID

Correct answer: A. The IPv4 header checksum

TTL is covered by the IPv4 header checksum. Link framing also changes as needed, but unrelated application values are not recomputed for this purpose.

1. Routers remove all frame error detection
2. The incoming FCS is valid for different outgoing bytes
3. The outgoing frame has different link-layer contents and needs its own integrity value
4. FCS is an unchanged end-to-end identifier

Correct answer: C. The outgoing frame has different link-layer contents and needs its own integrity value

Each new frame has link-specific fields and its own integrity computation. FCS is not carried as an unchanged end-to-end guarantee.

1. 1500
2. 1540
3. 1460 bytes
4. 1480

Correct answer: C. 1460 bytes

Subtract both headers from the IP packet budget: 1500 minus 20 minus 20 equals 1460. Link headers are outside the stated IP MTU.

1. A fixed immediate UDP offset after every base header
2. Ethernet FCS as a transport offset
3. The port value as a substitute for header parsing
4. The Next Header chain and each header’s defined structure

Correct answer: D. The Next Header chain and each header’s defined structure

IPv6 extension headers can appear between the base header and upper-layer data. Correct parsing follows the header chain rather than a fixed transport offset.

1. Network address only
2. Data link destination
3. Transport
4. Physical signaling

Correct answer: C. Transport

The IP address selects the host or network destination; the TCP port selects the transport endpoint within that host context.

1. Link-layer context before the intended IP path
2. A DNS serial issue
3. A guaranteed TLS identity error as the initiating fault
4. A TCP sequence wrap

Correct answer: A. Link-layer context before the intended IP path

Incorrect VLAN context can prevent reaching the intended local neighbors and routes. Diagnose the actual tagging/mapping before higher-level repairs.

1. Ping success proves every listener works
2. IP reachability from transport listener or policy behavior
3. The reset is a DNS cache result
4. Every reset is a broken physical cable

Correct answer: B. IP reachability from transport listener or policy behavior

Different protocol tests establish different stages. A reset is transport evidence to interpret with listener and policy context.

1. Successful certificate identity verification
2. Underlying IP delivery and TCP setup
3. Successful completion of the protected operation
4. Successful requested application authorization

Correct answer: B. Underlying IP delivery and TCP setup

Higher-stage failure can occur after lower stages succeed. Retain each observation rather than restarting at an unrelated cable hypothesis.

1. The application username
2. The outer destination
3. The DNS delegation target
4. The inner destination regardless of encryption

Correct answer: B. The outer destination

Transit forwarding follows the visible outer network header. The tunnel endpoint later processes the inner packet according to its role.

1. Increase every underlay MTU automatically
2. Limit every file to a single packet
3. Eliminate inner transport headers
4. Reduce the available inner packet budget

Correct answer: D. Reduce the available inner packet budget

Outer headers consume capacity on the underlay. Calculate the effective inner limit from the actual encapsulation and path.

1. An incomplete ARP exchange
2. A missing DNS reply
3. A physical link with no signal
4. A received forbidden response from the HTTP service

Correct answer: D. A received forbidden response from the HTTP service

The observed HTTP response is later-stage evidence. It does not by itself specify which access policy or identity caused the denial.

1. No, every TCP segment preserves a whole application message
2. No, messages must exactly match the MTU
3. Yes; TCP provides a byte stream without preserving application message boundaries
4. Yes, TCP automatically publishes message boundaries in DNS

Correct answer: C. Yes; TCP provides a byte stream without preserving application message boundaries

Applications define their own framing over TCP's byte stream. Segment boundaries do not reliably identify complete application objects.

1. Every fragment starts a new transport connection
2. Every later fragment must repeat the full TCP header
3. The missing header means the packet is necessarily ARP
4. The transport header was in the original packet's initial portion, not repeated in every fragment

Correct answer: D. The transport header was in the original packet's initial portion, not repeated in every fragment

IP fragmentation divides the original IP payload. Later fragments need reassembly context rather than independent full transport decoding.

1. At every Ethernet switch
2. At every transit router
3. At the recursive resolver
4. At the destination host

Correct answer: D. At the destination host

Destination reassembly reconstructs the original IP payload. Transit routers do not ordinarily reassemble every forwarded fragment.

1. No, IPv6 has no size limit
2. No; IPv6 routers do not perform fragmentation and can signal Packet Too Big
3. Yes, the router removes UDP bytes to fit
4. Yes, each IPv6 transit router fragments it

Correct answer: B. No; IPv6 routers do not perform fragmentation and can signal Packet Too Big

IPv6 fragmentation, when used, is a source function. Path size discovery depends on handling the appropriate control messages.

1. Only a valid cached hostname
2. Only the selected port number
3. A downstream capture or receiver evidence after checksum completion
4. Only the local warning color

Correct answer: C. A downstream capture or receiver evidence after checksum completion

Capture hooks can see packets before hardware finalizes checksums. The warning requires observation context and corroboration.

1. The application resolver performs all link rewriting
2. Only the chassis label determines processing
3. The word switch means no link wrapper changes
4. Its routed forwarding between the interfaces

Correct answer: D. Its routed forwarding between the interfaces

Device labels do not replace function analysis. Routing between link contexts creates the relevant outgoing framing.

1. The port field is inside the transport header, not the Ethernet destination field
2. FCS declares the port independently of payload headers
3. The port is inside the Ethernet destination address
4. Port 443 is the physical switchport number

Correct answer: A. The port field is inside the transport header, not the Ethernet destination field

Fields occur in different protocol wrappers. Policy interpretation also needs fragmentation, encryption and implementation context.

1. The DNS record TTL
2. The MX preference
3. The final frame's destination MAC
4. The SOA serial

Correct answer: C. The final frame's destination MAC

Link delivery uses MAC context while UDP and DNS data are processed after network delivery. Do not confuse DNS answer fields with framing.

1. Both organize functions, but their layer grouping is not a mandatory one-to-one implementation map
2. TCP/IP has no application functions
3. Layer labels alone identify the failed component
4. Every implementation must map layers one to one

Correct answer: A. Both organize functions, but their layer grouping is not a mandatory one-to-one implementation map

Models support reasoning about stages. Actual protocols and implementations need their own evidence and may span conceptual categories.

1. Yes, a new frame implies a new application peer
2. No; the next-hop path can change while the destination IP remains the same
3. No, local next-hop identity can never change
4. Yes, every route change rewrites the final server

Correct answer: B. No; the next-hop path can change while the destination IP remains the same

Path selection and endpoint translation are separate functions. Identify which fields actually change at each boundary.

1. 0 bytes
2. 40 bytes
3. 60 bytes
4. 20 bytes

Correct answer: D. 20 bytes

The outer packet is 1520 bytes. It exceeds the 1500-byte budget by 20, so a supported size-handling strategy is required.

1. 1460 bytes
2. 1560 bytes
3. 1500 bytes
4. 1440 bytes

Correct answer: D. 1440 bytes

Subtract all stated encapsulation overhead from the underlay budget. This is the inner IP packet ceiling, not yet the inner application's payload limit.

1. 1420 bytes
2. 1440 bytes
3. 1388 bytes
4. 1400 bytes

Correct answer: C. 1388 bytes

Subtract the actual inner headers: 1440 minus 20 minus 32 equals 1388. Assuming a fixed 20-byte TCP header would overestimate the payload here.

1. 600 bytes
2. 604 bytes
3. 580 bytes
4. 620 bytes

Correct answer: A. 600 bytes

There are 600 bytes after the header budget, and 600 is divisible by eight. Nonfinal fragment payloads need that alignment.

1. 0, 74, 148
2. 0, 75, 150
3. 0, 620, 1240
4. 0, 600, 1200

Correct answer: B. 0, 75, 150

Payload begins at byte offsets 0, 600 and 1200. Dividing each by eight gives fragment offsets 0, 75 and 150; the last payload is 280 bytes.

1. Treat the oversized packet as a successful path-size probe
2. Discard it and, when applicable, send ICMP fragmentation-needed information
3. Fragment while ignoring DF
4. Forward the oversized packet unchanged onto the smaller link

Correct answer: B. Discard it and, when applicable, send ICMP fragmentation-needed information

DF prohibits router fragmentation. Appropriate ICMP feedback can help the sender reduce size; restrictions and filtering can affect whether it receives that signal.

1. Treat a listener check as proof that large data crosses
2. Change only name-server records
3. Conclude that small success proves the full path size
4. Path MTU handling and retransmissions at the large-packet boundary

Correct answer: D. Path MTU handling and retransmissions at the large-packet boundary

The size threshold and missing feedback support an MTU hypothesis. Confirm actual packet sizes and loss rather than assume every slow transfer has this cause.

1. Every UDP payload sent by that host
2. The complete application's object size
3. The physical link's supported frame size
4. The TCP data a peer sends per segment, not every other protocol's packet size

Correct answer: D. The TCP data a peer sends per segment, not every other protocol's packet size

MSS concerns TCP payload size under the negotiated connection behavior. It does not fix unrelated UDP or every encapsulation path by itself.

1. A guaranteed 64 KB frame on the wire
2. A proof that segmentation is unnecessary
3. A guaranteed path MTU of 64 KB
4. Offload/coalescing view from actual wire segmentation

Correct answer: D. Offload/coalescing view from actual wire segmentation

Host capture hooks can observe large units before segmentation. Use on-wire or receiver evidence to establish actual transmitted sizes.

1. The valid FCS guarantees every inner checksum
2. The bad IP checksum makes the outer FCS necessarily invalid
3. Link integrity can be valid for contents that still fail network-layer integrity checks
4. Both checks cover exactly the same bytes

Correct answer: C. Link integrity can be valid for contents that still fail network-layer integrity checks

Each integrity check covers its defined content. A transmitter can form a valid frame around an invalid inner header.

1. The transport listener necessarily becomes a router management port
2. Source and destination IPs can remain, while TTL and header checksum change
3. Every byte of the original IP header is unchanged
4. The original Ethernet addresses survive the routed hop

Correct answer: B. Source and destination IPs can remain, while TTL and header checksum change

Forwarding preserves endpoint addresses in this scenario but updates hop-lifetime and associated integrity. Avoid claiming every network-layer field is immutable.

1. The exact encrypted inner request body
2. The specific hidden inner transport port
3. The authenticated inner user's role
4. The visible outer destination, not an unobserved specific inner application endpoint

Correct answer: D. The visible outer destination, not an unobserved specific inner application endpoint

Encrypted encapsulation limits visibility. Use authorized endpoint or tunnel evidence for claims beyond the observable outer header.

1. As separate transport connections with their own endpoint and sequence contexts
2. One unchanged Ethernet frame across both sides
3. One set of client source ports necessarily reused for the backend
4. One preserved TCP sequence space across both connections

Correct answer: A. As separate transport connections with their own endpoint and sequence contexts

A proxy termination creates a new connection. Correlate application requests or proxy logs rather than assuming the transport fields are preserved.

1. TCP checksum covers only TCP payload and no pseudo-header
2. TCP checksum coverage includes a pseudo-header containing IP endpoint information
3. IP address changes cannot affect TCP checksum coverage
4. The Ethernet FCS substitutes for updating transport integrity

Correct answer: B. TCP checksum coverage includes a pseudo-header containing IP endpoint information

The pseudo-header binds transport integrity to relevant network-layer fields. Translation must keep applicable checksums consistent with the resulting packet.

1. Ignore fragment association when making port rules
2. Fragment association and supported inspection behavior instead of pretending every fragment has a full transport header
3. Classify every later fragment as the first fragment's full TCP header
4. Read the transport ports at a fixed offset in every fragment

Correct answer: B. Fragment association and supported inspection behavior instead of pretending every fragment has a full transport header

Port-based decisions need the implementation's fragment handling. Avoid interpreting nonexistent header bytes as a complete independent segment.

1. The application payload always shrinks automatically
2. The packet requires 2028 bytes, which exceeds the stated MTU
3. UDP overhead disappears for larger messages
4. MTU matters only for TCP packets

Correct answer: B. The packet requires 2028 bytes, which exceeds the stated MTU

The application payload plus headers is 2028 bytes. A supported size strategy is needed; UDP does not make overhead disappear.

1. Only corrupt frames lack FCS in stored captures
2. Every capture includes every transmitted framing byte
3. An absent stored FCS proves the physical link uses none
4. No; NIC or capture processing can omit it from the stored observation

Correct answer: D. No; NIC or capture processing can omit it from the stored observation

The stored capture representation need not include all wire framing. Check capture hardware and settings before making transmission claims.

1. 1500 bytes
2. 1520 bytes
3. 1472 bytes
4. 1480 bytes

Correct answer: A. 1500 bytes

Tool argument semantics matter. Add the stated 28 bytes of IP and ICMP overhead to obtain the IP packet size.

1. The tests may use different paths, encapsulation, headers or size semantics
2. A successful ping proves every tunnel has the same budget
3. All protocols have equal overhead on every route
4. The tool's payload argument always means total IP size

Correct answer: A. The tests may use different paths, encapsulation, headers or size semantics

Size comparisons require the actual packet budget and path for each test. A different protocol or tunnel can have a different effective limit.

1. No, tagging adds no link-frame bytes
2. No; check supported frame size and configured IP MTU rather than subtracting automatically
3. Yes, every capable trunk must reduce its IP MTU
4. Yes, the tag is inserted into the IP payload

Correct answer: B. No; check supported frame size and configured IP MTU rather than subtracting automatically

Link-frame support and IP MTU are related but distinct specifications. A trunk can support the larger frame needed for a 1500-byte IP packet.

1. Every retry uses the original frame checksum
2. Retries always retain identical TCP sequence state
3. Application meaning permanently determines link addresses
4. New connections can have different ports, sequence state and link paths

Correct answer: D. New connections can have different ports, sequence state and link paths

Protocol state is regenerated as needed. Correlate the operation using appropriate application context rather than expecting byte-identical wrapping.

1. 61
2. 63
3. 3
4. 64

Correct answer: A. 61

Three forwarding hops decrement the initial value by three. The numeric example states one decrement per router and no additional routed hops.

1. The exact protected request body
2. The observed IP endpoints
3. The observed transport ports
4. The observed packet lengths

Correct answer: A. The exact protected request body

Outer metadata can be visible while application content is protected. Do not infer specific protected content from ports alone.

1. Assume every function preserves all endpoint fields
2. Use the device's label to exclude translation and tunneling
3. Treat inner and outer headers as a single address pair
4. List the actual functions and fields at each boundary, including inner and outer identities

Correct answer: D. List the actual functions and fields at each boundary, including inner and outer identities

Several functions can occur in one device. A boundary table prevents conflating route forwarding, address translation and encapsulation.

1. Only the device's Layer 2 product label
2. Only any learned MAC entry
3. Correct VLAN, current MAC location and observed request/reply forwarding for the relevant task
4. Only the switch's intended VLAN diagram

Correct answer: C. Correct VLAN, current MAC location and observed request/reply forwarding for the relevant task

A layer label is not an acceptance test. Demonstrate the specific forwarding behavior and context needed by the task.