AP Networking TCP and UDP Transport Troubleshooting Practice Test

1. DNS-name ownership
2. Automatic encryption for all payload
3. A reliable ordered byte stream
4. Guaranteed low latency regardless of load

Correct answer: C. A reliable ordered byte stream

TCP handles sequencing and retransmission for its stream. Encryption and application semantics require additional mechanisms.

1. A mandatory three-way handshake
2. A reliable byte stream identical to TCP
3. Automatic TLS certificates
4. Datagrams without TCP-style reliable ordered delivery

Correct answer: D. Datagrams without TCP-style reliable ordered delivery

UDP does not include TCP's stream reliability machinery. An application using UDP may add its own reliability.

1. DNS NXDOMAIN
2. FIN
3. SYN
4. ARP reply

Correct answer: C. SYN

A normal TCP opening begins with SYN, followed by SYN-ACK and ACK. ARP is a separate local-link operation.

1. SYN-ACK
2. FIN only
3. DNS MX
4. DHCPACK

Correct answer: A. SYN-ACK

SYN-ACK acknowledges the initiating sequence and supplies the peer's initial sequence. A later ACK completes normal setup.

1. It changes the DNS hostname
2. It creates a new Ethernet standard
3. It can retransmit the missing stream data
4. It assumes UDP repaired it

Correct answer: C. It can retransmit the missing stream data

TCP reliability includes retransmission. The evidence still needs context to distinguish loss, delay, and capture limitations.

1. An IPv4 network prefix
2. An endpoint/service within the transport protocol
3. A VLAN's radio channel
4. The cable's copper pairs

Correct answer: B. An endpoint/service within the transport protocol

Ports distinguish conversations and services on a host. TCP and UDP have separate port spaces.

1. Both are DNS ports
2. 443
3. Neither because HTTPS has no port
4. 53000

Correct answer: B. 443

The server listener commonly uses 443; the client typically selects an ephemeral source port.

1. Yes, all TCP is TLS
2. No
3. Yes, only if the source is private
4. Only on port 80

Correct answer: B. No

TCP reliability and encryption are separate. TLS or another security mechanism can operate above it.

1. VLAN order
2. DHCP lease rank
3. Positions in the byte stream
4. DNS record versions

Correct answer: C. Positions in the byte stream

Sequence values let TCP order stream data and detect gaps. They are not application-message IDs by default.

1. The next byte expected under its cumulative acknowledgment semantics
2. That the user read the message
3. That DNS resolved correctly
4. That the whole file is saved to disk

Correct answer: A. The next byte expected under its cumulative acknowledgment semantics

A transport acknowledgment concerns received stream bytes. Application completion and durable storage are separate claims.

1. Sending application datagrams where late delivery may be less useful
2. Replacing all addressing
3. Guaranteeing no packet loss
4. Encrypting every Ethernet frame automatically

Correct answer: A. Sending application datagrams where late delivery may be less useful

Some real-time applications choose datagram behavior and implement their own handling. UDP does not guarantee timeliness or losslessness.

1. Variation in packet delay
2. A cable connector type
3. A fixed DNS TTL
4. Total usable subnet addresses

Correct answer: A. Variation in packet delay

Delay variation can affect playback and interactive communication. It is distinct from average delay and packet-loss rate.

1. A smaller subnet automatically
2. A low DNS cache hit rate only
3. A mandatory TCP disconnect every minute
4. Expected traffic failing to arrive at the observation point

Correct answer: D. Expected traffic failing to arrive at the observation point

Loss is about missing delivery relative to the test. Capture placement and measurement assumptions must be stated.

1. Proof every remote client is permitted
2. A DNS alias
3. An endpoint ready to accept connection attempts under its binding
4. A VLAN trunk

Correct answer: C. An endpoint ready to accept connection attempts under its binding

Listening state is server-side evidence. Routes, firewall policy, and application authorization remain separate.

1. UDP never uses 53
2. TCP 53 covers every protocol
3. It does not automatically permit UDP 53
4. DNS cannot use TCP

Correct answer: C. It does not automatically permit UDP 53

Protocol and port are both match criteria. Conventional DNS may require both TCP and UDP paths.

1. A successful DNS answer
2. An abrupt rejection or termination at the observed point
3. A DHCP lease extension
4. A cable-length certification

Correct answer: B. An abrupt rejection or termination at the observed point

A reset is an explicit transport response. Determine which endpoint or intermediary generated it and why.

1. VLAN reassignment
2. Deletion of DNS records
3. Orderly closure of one sending direction
4. A new IPv4 lease

Correct answer: C. Orderly closure of one sending direction

FIN participates in orderly connection shutdown. TCP directions can close separately.

1. Only if both hosts are private
2. Yes, UDP acknowledges everything
3. No
4. Yes, IP orders every packet

Correct answer: C. No

Datagrams are independent at this layer. A successful sample does not establish complete ordered delivery of the stream of messages.

1. The cable from high voltage
2. The receiver from being overwhelmed beyond its advertised capacity
3. Every DNS zone from expiry
4. Every router from all congestion

Correct answer: B. The receiver from being overwhelmed beyond its advertised capacity

The receive window reflects receiver capacity. Congestion control addresses different path conditions.

1. Network-path conditions affecting safe sending rate
2. Only the DHCP lease duration
3. Only the destination hostname length
4. Only the user's password

Correct answer: A. Network-path conditions affecting safe sending rate

Congestion control governs sending behavior based on path feedback. It differs from receiver flow control.

1. Initial transport exchange with the tested endpoint/path
2. A trusted TLS certificate
3. Every future payload will succeed
4. Successful user login

Correct answer: A. Initial transport exchange with the tested endpoint/path

Connection setup is a stage, not full application success. Larger data or subsequent security/application work can still fail.

1. Applications can add reliability above UDP
2. DNS changes UDP into Ethernet
3. Every UDP acknowledgment is DHCP
4. UDP mandates TCP SYN

Correct answer: A. Applications can add reliability above UDP

UDP's minimal transport service does not prevent an application protocol from implementing feedback or retransmission.

1. Source 53 to destination 67
2. Source 54000 to destination 22
3. Source 22 to destination 54000
4. Source 22 to destination 22 always

Correct answer: C. Source 22 to destination 54000

The response reverses endpoint roles. This matters for captures and stateless packet-filter rules.

1. Only subnet size
2. Source, destination, transport, port, and outcome
3. Only cable color
4. Only the hostname label

Correct answer: B. Source, destination, transport, port, and outcome

The full flow context distinguishes one working service path from another filtered or unavailable one.

1. Yes, bandwidth and latency are identical
2. Yes, DNS becomes instant
3. Only if TCP is disabled
4. No

Correct answer: D. No

Processing, propagation, contention, retransmission, and server behavior can remain limiting even with more nominal capacity.

1. Application authentication
2. Initial TCP setup
3. DHCP allocation
4. Ethernet link negotiation

Correct answer: A. Application authentication

The observed exchange reached the application. A 401 points toward identity requirements rather than missing transport setup.

1. That TCP setup completed
2. That the cable is certainly broken
3. Whether the path/policy or destination listener caused silence
4. That DNS is certainly wrong

Correct answer: C. Whether the path/policy or destination listener caused silence

Missing responses can have several causes. Use server-side evidence and policy logs to separate delivery from service behavior.

1. An explicit response is observed
2. DNS returned NXDOMAIN
3. No packet came back
4. The handshake completed

Correct answer: A. An explicit response is observed

A reset provides active rejection/termination evidence. Confirm its generating device and the listener/policy context.

1. Every retransmission proves a corrupt cable
2. The user certainly saved the file
3. The sender attempted to recover stream bytes not acknowledged as expected
4. DNS changed the address

Correct answer: C. The sender attempted to recover stream bytes not acknowledged as expected

Retransmission indicates recovery behavior, but the cause could involve loss, delay, or observation placement.

1. Only the subnet mask
2. Only the sender's DNS TTL
3. Receiver/application ability to consume incoming data
4. Only the AP SSID

Correct answer: C. Receiver/application ability to consume incoming data

A zero receive window is flow-control evidence. It is not automatically proof of congestion on the WAN.

1. DNS aliasing
2. MAC aging only
3. Jitter
4. Subnet overlap

Correct answer: C. Jitter

Variation can disrupt consistent playback even when average delay looks acceptable. Examine buffering, loss, and time distribution.

1. TCP 443 covers UDP automatically
2. The allowed transport does not match the attempted flow
3. The port number is invalid
4. QUIC requires DHCP 67

Correct answer: B. The allowed transport does not match the attempted flow

QUIC commonly operates over UDP. Numeric port equality does not make protocol-specific rules interchangeable.

1. Only DNS PTR records
2. Only address-pool capacity
3. Only Ethernet speed
4. The intended endpoint/port or proxy mapping

Correct answer: D. The intended endpoint/port or proxy mapping

A correct destination IP does not guarantee the requested port hosts the service. Confirm the supported application endpoint.

1. Every connection needs a different server IP
2. The endpoint tuples distinguish the flows
3. DNS gives each a new port
4. TCP cannot support this

Correct answer: B. The endpoint tuples distinguish the flows

Source/destination addresses and ports, with transport context, distinguish multiple connections to one listener.

1. DNS changes physical speed
2. Ethernet LEDs disable packets
3. Retransmission and congestion-control behavior
4. Subnet masks throttle TCP universally

Correct answer: C. Retransmission and congestion-control behavior

Payload delivery can fall below link capacity as TCP reacts to missing or delayed acknowledgments and resends data.

1. Only DHCP lease length
2. Only the gateway's cable
3. Only SYN retry counts
4. Certificate identity and the intended service endpoint

Correct answer: D. Certificate identity and the intended service endpoint

TLS identity validation is later than the demonstrated transport setup. Verify the requested name and certificate served.

1. Return path, reply tuple, and filtering
2. Only the server hostname
3. Only request delivery
4. Only the DNS suffix

Correct answer: A. Return path, reply tuple, and filtering

Request arrival demonstrates one direction. UDP replies still require a usable permitted reverse path.

1. TCP sequence bit length
2. The numeric meaning of port 443
3. Listener binding, path, policy, and source context
4. The server's IPv4 address length

Correct answer: C. Listener binding, path, policy, and source context

Local tests may use loopback or bypass external filtering. Reproduce the remote flow before generalizing.

1. Only if the packet is encrypted
2. Yes, DNS preserves record boundaries
3. No; TCP is a byte stream
4. Yes, each write is one packet

Correct answer: C. No; TCP is a byte stream

TCP can combine or split application writes. The application protocol must define its own message boundaries.

1. Only the hostname length
2. Congestion window, round-trip time, loss, and workload
3. Only VLAN ID
4. Only the advertised receive window

Correct answer: B. Congestion window, round-trip time, loss, and workload

Receiver capacity is one constraint. TCP's allowed in-flight data and path feedback also affect achieved throughput.

1. Packet-size/path MTU behavior and required feedback, alongside application evidence
2. Only loopback ping
3. Only DNS name existence
4. Only the SSID label

Correct answer: A. Packet-size/path MTU behavior and required feedback, alongside application evidence

Size-dependent failure can expose MTU or filtering issues after initial setup. Measure rather than assuming all larger-transfer failures have one cause.

1. A mandatory DHCP port
2. An Ethernet VLAN tag
3. The server's HTTPS listening port
4. The client's ephemeral endpoint for this flow

Correct answer: D. The client's ephemeral endpoint for this flow

Reply direction reverses the request tuple. The client port identifies the return endpoint of that conversation.

1. Every user's password
2. Application-level gaps or reordering
3. DNS authority
4. Ethernet conductor faults automatically

Correct answer: B. Application-level gaps or reordering

The application can track datagram order and missing messages. UDP itself does not supply TCP-style stream sequencing.

1. Delivery of the server reply to the client
2. Server receipt of the initial SYN necessarily
3. The existence of a response attempt
4. The server-side observation

Correct answer: A. Delivery of the server reply to the client

Different capture points establish different path segments. Trace the reverse flow before asserting client refusal.

1. That one reply was observed
2. That the tested endpoint responded
3. That some exchange occurred
4. Sustained loss/jitter behavior and all application functions

Correct answer: D. Sustained loss/jitter behavior and all application functions

A single exchange is bounded evidence. Real-time quality requires representative sampling under relevant load.

1. Only DNS serial numbers
2. Loaded-versus-idle latency and queue/utilization evidence
3. Only the subnet broadcast
4. Only route names

Correct answer: B. Loaded-versus-idle latency and queue/utilization evidence

Queueing under load can change delay without changing propagation distance. Correlate the traffic period with path measurements.

1. Receiver-side consumption is limiting flow
2. DNS stopped answering
3. The WAN is necessarily disconnected
4. The client's MAC must be duplicated

Correct answer: A. Receiver-side consumption is limiting flow

Window behavior reflects available receive capacity. Check the application and host resource state as well as network traffic.

1. Only the shared numeric port
2. Only DHCP option 6
3. The distinct transport and policy paths
4. Only private address ranges

Correct answer: C. The distinct transport and policy paths

TCP-based HTTPS and QUIC-based HTTP/3 can have different permitted paths even at port 443.

1. Assume every protocol must work
2. Replace DNS without checking its role
3. That service's request/reply and relevant policy
4. Change the IP prefix blindly

Correct answer: C. That service's request/reply and relevant policy

ICMP success does not validate UDP service state or permissions. Observe the actual protocol flow.

1. The route is certainly missing
2. Every packet is fully explained
3. The handshake never occurred
4. Missing earlier context may affect interpretation of sequence and state

Correct answer: D. Missing earlier context may affect interpretation of sequence and state

Incomplete capture context can omit setup, earlier acknowledgments, or prior path changes. State that limitation explicitly.

1. DNS name absence
2. DHCP pool exhaustion
3. A path-MTU/packet-size feedback problem
4. Initial authentication to Wi-Fi

Correct answer: C. A path-MTU/packet-size feedback problem

The size-dependent symptom follows setup. Check MTU, packet sizes, and needed feedback rather than assuming the successful handshake certifies all payload delivery.

1. Only cable color
2. The acknowledgment/return path and capture timing
3. Only DHCP addresses
4. Only the forward destination name

Correct answer: B. The acknowledgment/return path and capture timing

Data arrival and sender recovery can coexist if acknowledgments are delayed or lost. Correlate both directions and timestamps.

1. 1.25 MB
2. 100 bytes
3. 100 MB
4. 12.5 KB

Correct answer: A. 1.25 MB

100 million bits per second times 0.1 second is 10 million bits, or about 1.25 million bytes. This is a capacity-times-delay estimate, not guaranteed throughput.

1. The congestion-control constraint can be tighter
2. The receiver window always overrides every limit
3. Link rate alone guarantees full throughput
4. DNS TTL fixes the window

Correct answer: A. The congestion-control constraint can be tighter

TCP respects both receiver and congestion constraints. A large advertised receive window does not remove the smaller sender-side limit.

1. Asymmetric routing and the intended stateful enforcement design
2. Only Ethernet full duplex
3. Only the service's DNS spelling
4. Only the client's subnet capacity

Correct answer: A. Asymmetric routing and the intended stateful enforcement design

The reverse path must satisfy the policy it encounters. A permit/state entry on one device does not automatically exist on another.

1. No; it can be an intentional application tradeoff
2. No; UDP guarantees no loss
3. Yes; UDP forbids sequencing
4. Yes; all applications must use TCP

Correct answer: A. No; it can be an intentional application tradeoff

The application can prefer timeliness to recovery of old data. Evaluate actual quality and requirements rather than prescribing one transport universally.

1. The user successfully stored all corresponding application content
2. Cumulative acknowledgment moved forward
3. The receiver acknowledged stream progress
4. More bytes were accounted for at transport level

Correct answer: A. The user successfully stored all corresponding application content

TCP acknowledgment is not proof of durable storage or completed user workflow. Application-level confirmation is a separate layer.

1. Checking policy logs
2. Recording the observed response source
3. Comparing a server-side capture
4. Attributing the reset to the server without identifying its generator

Correct answer: D. Attributing the reset to the server without identifying its generator

An intermediary can generate rejection responses. Confirm observation point and source before assigning endpoint blame.

1. Duplicate detection or idempotent request handling
2. Only a wider subnet
3. Only Ethernet port density
4. Only a longer DNS name

Correct answer: A. Duplicate detection or idempotent request handling

Application reliability over UDP may create duplicates. Correctness needs transaction identity and safe repeated-operation semantics where appropriate.

1. Only Wi-Fi passphrase
2. Only DNS TTL
3. Segmentation/receive offload and capture placement
4. Only route count

Correct answer: C. Segmentation/receive offload and capture placement

Host offload can alter what software captures display before or after NIC processing. Compare on-wire evidence with endpoint capture context.

1. Receiver/application buffering and consumption
2. Only the provider's advertised link rate
3. Only DNS cache size
4. Only the subnet prefix

Correct answer: A. Receiver/application buffering and consumption

A tight advertised window can limit in-flight data even on a healthy path. Check receiver constraints with representative measurements.

1. TCP replies have no ports
2. The reply destination is the client's ephemeral port, not 443
3. HTTPS bypasses ACLs
4. The server reply source is never 443

Correct answer: B. The reply destination is the client's ephemeral port, not 443

For the return flow, source and destination roles reverse. Match the actual reverse tuple and the correct filtering model.

1. Only the common hostname
2. Only source MAC vendors
3. Only DNS TTL increases
4. Each member's service, payload path, and policy separately

Correct answer: D. Each member's service, payload path, and policy separately

The hostname can select different endpoints. Member-specific evidence can isolate a partial service/path failure.

1. UDP 443 and TCP 443 are identical
2. One transport variant does not prove the other required variants work
3. DNS must be disabled
4. QUIC cannot carry web traffic

Correct answer: B. One transport variant does not prove the other required variants work

Application availability depends on supported clients and transport paths. Test each required variant explicitly.

1. Only transit packet loss
2. Only intermediate link bandwidth
3. Only the server's receive window
4. Client-side preconnection work such as resolution or application behavior

Correct answer: D. Client-side preconnection work such as resolution or application behavior

Delay before the connection attempt is outside the observed TCP path exchange. Time the preceding steps separately.

1. TCP cannot order bytes
2. UDP repaired the stream
3. DNS changes data boundaries
4. TCP does not preserve application write/message boundaries

Correct answer: D. TCP does not preserve application write/message boundaries

The application must frame its messages using length, delimiters, or protocol rules. Reliable byte delivery does not define records.

1. DHCP has no free addresses
2. The cable is certainly broken
3. DNS definitely failed
4. Application identity handling triggered connection termination

Correct answer: D. Application identity handling triggered connection termination

Transport closure can be a consequence of an application decision. Correlate logs with the failed stage rather than treating every reset as physical failure.

1. Only the server MAC
2. Only IPv4 prefix length
3. Only DNS record type
4. The application's timing and the boundary's supported state/timeout behavior

Correct answer: D. The application's timing and the boundary's supported state/timeout behavior

Translated datagram traffic may depend on mapping lifetime. Evaluate the intended protocol and state timing rather than assuming UDP is stateless at every middlebox.

1. Packet loss is impossible
2. DNS increases utilization automatically
3. Receiver window never matters
4. The sender may be unable to keep the path fully utilized

Correct answer: D. The sender may be unable to keep the path fully utilized

Without enough outstanding data, the sender can wait for feedback while capacity sits unused. This is one possible throughput constraint among others.

1. Only RSSI at idle
2. Only the lease duration
3. Queueing and shared-path load during the upload
4. Only DNS A record count

Correct answer: C. Queueing and shared-path load during the upload

Load-correlated delay/jitter can arise at shared queues. Compare affected-path utilization and timing under controlled workloads.

1. Both client-to-proxy and proxy-to-service endpoint tuples
2. Only the client's original destination
3. Only the local gateway LED
4. Only the subnet mask

Correct answer: A. Both client-to-proxy and proxy-to-service endpoint tuples

The proxy creates separate transport legs. A permit and successful setup on one leg do not certify the other.

1. DNS must have returned NXDOMAIN
2. Every retransmission proves cable corruption
3. Transient loss/reordering or changed delay may have triggered recovery; correlate path evidence
4. The server is permanently offline

Correct answer: C. Transient loss/reordering or changed delay may have triggered recovery; correlate path evidence

Route changes can affect packet arrival and feedback. Use timing and multiple observation points before fixing one cause.

1. Yes; retransmission changes the IP protocol number automatically
2. No; it is an application protocol using UDP with added mechanisms
3. No; UDP forbids all acknowledgments
4. Yes; every UDP ACK is a TCP ACK

Correct answer: B. No; it is an application protocol using UDP with added mechanisms

Reliability can be implemented above UDP without becoming a TCP byte stream. The transport identity and application semantics remain distinct.

1. Transport setup from protocol negotiation and application completion
2. Only physical link detection
3. Only private address status
4. Only port-number spelling

Correct answer: A. Transport setup from protocol negotiation and application completion

Connected usually reports a bounded transport state. Observe subsequent messages, authentication, and expected response semantics.

1. Filtering alone was proven responsible
2. The combined change improved the test; the individual cause is not isolated
3. Both were unnecessary
4. Buffering alone was proven responsible

Correct answer: B. The combined change improved the test; the individual cause is not isolated

Two changed dependencies prevent clean attribution. Record the final configuration and repeat controlled tests if isolation is needed.