Network Architectures and Protocols

The packet that crossed the café

A person in a café opens a laptop, joins the open wireless network, and types an address into the browser. What happens next is a chain of decisions that the exam calls network architecture, and almost every question in Domain 4 is a question about one link in that chain. The browser does not know where the address lives, so it asks a resolver to turn the name into a number, which is DNS. It wants a private conversation with the server, so the transport layer opens a connection with a three-message exchange called the TCP handshake, and the TLS layer on top of that negotiates keys and encrypts everything after the handshake. The request itself is an HTTP message. The network layer stamps the server’s IP address on the message and sends it to the default gateway, a router. The data link layer wraps the message into frames addressed to the next device on the wire, and the physical layer turns each frame into electrical or radio signals. At every router along the path, the frame is unwrapped, the destination IP address is compared to the router’s forwarding table, the frame is rewrapped for the next hop, and the process repeats until the request reaches the server, which then performs the whole journey in reverse, with the laptop’s address as the destination.

Notice what stays the same and what changes. The HTTP request survives every hop untouched. The IP addresses in its header survive end to end: the café laptop’s address and the server’s address are the same two numbers for the entire trip. The MAC addresses, the hardware addresses of the devices actually passing the frame, change at every hop, because each local link has its own set of physically attached devices. The frame itself is a disposable envelope, torn open and rebuilt by every router, while the packet it carries is the cargo that the routers hand to each other.

This one journey contains the entire chapter. The layers are a division of labor: each layer solves its own problem, applications do not need to know about cables, and cables do not need to know about applications. The protocols are the languages each layer speaks. The devices are the machines that translate between layers. Segmentation is the practice of splitting the map into controlled regions so a compromise in one region does not reach the others. Wireless replaces the cable with radio and inherits every security problem of a medium that cannot be locked in a closet. And the attacks are the ways the chain can be broken, which the next chapter answers with countermeasures.

Why networks are built in layers

The network is the oldest systems-integration problem in computing. Thousands of vendors make computers, cables, radios, switches, and applications, and they all need to interoperate without agreeing on each other’s internal design. The answer, adopted everywhere, is to partition the communication problem into layers, where each layer provides a service to the layer above it and uses the services of the layer below it, and the interfaces between layers are the only things that have to be standardized.

The textbook version of this idea is the Open Systems Interconnection reference model, published by ISO and IEC as ISO/IEC 7498-1 in 1984. It defines seven layers: physical, data link, network, transport, session, presentation, and application. The version the industry actually deploys, the TCP/IP model, has four layers: link, internet, transport, and application. The exam uses both, and the practical reality is simpler than either: applications talk to transport, transport talks to network, network talks to link, and the link talks to the wire. The OSI layers above transport, the session and presentation layers, no longer correspond to distinct pieces of deployed software; their jobs were absorbed by the application layer and by protocols such as TLS. But the exam still asks about them, because the vocabulary appears in security literature and in the blueprint, so they must be learned even where the industry has quietly retired them.

The deeper reason to care about layering is security. Every security control on a network lives at a layer or, more often, spans several. A firewall inspects packets at the network and transport layers and, in its application-aware form, the application layer. A wireless encryption standard protects the data link layer. TLS protects the application payload by sitting just above the transport layer. When a candidate can place an attack or a control at its layer, the answer to half of Domain 4 is already determined, because the options in a well-written question each name a different layer or a different protocol, and only one fits.

The seven layers, what lives in each, and what the exam asks

The OSI layers are conventionally taught from the top down, because that is the direction a message travels as it leaves an application, and from the bottom up, because that is how the medium sees data. Both directions matter. The exam cares about four things per layer: its number, its name, the PDU it produces, and the protocols and devices that live there.

Layer 7, the application layer, is where the user-facing protocols live: HTTP, HTTPS, SMTP, IMAP, DNS, SSH, and the other protocols whose names ordinary users recognize. Despite its name, the application layer is not the application itself; it is the protocol the application speaks. The security significance is that this is the layer of input validation, web application firewalls, and most vulnerabilities that get exploited against code. The exam’s application-layer questions are usually protocol questions, and the layer’s job in the model is to provide the service the user actually asked for.

Layer 6, the presentation layer, is defined as the layer that handles data representation: character encoding, compression, and, in the original design, encryption. In modern stacks, TLS sits logically in this slot, between the application protocol and the transport protocol, and the exam sometimes tests that placement. The practical footnote is that almost nothing today calls itself a presentation-layer protocol. The exam still expects the candidate to know the layer exists and what it was for, because the definition appears in ISO/IEC 7498-1 and in the literature that grew from it.

Layer 5, the session layer, is defined as the layer that establishes, manages, and tears down dialogs between applications: who speaks, in what order, and how a broken dialog resumes. Old protocol families such as NetBIOS and the remote procedure call stacks of the 1980s and 1990s had real session layers. Modern protocols folded session management into the application, which is why the exam treats the session layer mostly as a definitional item. It does have one security afterlife: session management, the establishment, authentication, and expiry of logged-in sessions, is where session hijacking attacks live, and the concept transfers directly to web applications even though the mechanism is application-layer.

Layer 4, the transport layer, is one of the two layers the exam treats as load-bearing. Its job is to deliver the right amount of data to the right application on the right host. Two protocols divide the work. TCP, defined in RFC 793 and updated by RFC 9293, provides a reliable, ordered, connection-oriented byte stream: it numbers its segments, acknowledges receipt, retransmits what was lost, and slows down when the network is congested. UDP, defined in RFC 768, is a connectionless datagram service: it puts a header on the data and sends it, with no acknowledgment, no ordering guarantee, and no retransmission. The transport layer is also where ports live, the 16-bit numbers that identify which application on a host a segment is for. The PDU at this layer is the segment, though UDP’s segment is usually called a datagram. The exam’s transport questions ask which protocol a scenario needs, which ports a protocol uses, and what a stateful inspection firewall must track, which is the TCP connection state.

Layer 3, the network layer, is the second load-bearing layer. Its job is to deliver packets across the whole internetwork, not just across one wire, and its protocol is IP. IPv4, defined in RFC 791, uses 32-bit addresses; IPv6, defined in RFC 8200, uses 128-bit addresses. Routers operate here, forwarding packets based on the destination address in the header and a routing table learned from routing protocols or configured by administrators. The PDU is the packet. Two supporting protocols belong to this layer in the exam’s telling: ICMP, defined in RFC 792, which reports errors and carries the ping echo messages used to test reachability, and ARP, defined in RFC 826, which resolves IP addresses to MAC addresses on the local segment. The network layer is where routing, NAT, subnetting, and IP-based access control lists live.

Layer 2, the data link layer, moves frames between directly connected devices. Its defining components are the MAC address, the 48-bit hardware address burned into network interfaces, and the frame, the PDU that wraps the packet with source and destination MAC addresses plus error-detection fields. Ethernet, standardized by IEEE 802.3, is the dominant wired protocol here. Switches and bridges operate at this layer, learning which MAC address is reachable out of which port and forwarding frames accordingly. Wireless LANs, IEEE 802.11, are also link layer technologies, which is why wireless encryption is described as protecting the data link layer. The frame’s addresses are only meaningful within one hop: the frame is addressed to the next device toward the destination, not to the destination itself, which is why every router rewraps the packet in a new frame.

Layer 1, the physical layer, is the wire, the radio frequency, the fiber, the connector, and the bit stream. It moves bits, nothing more. Hubs and repeaters live here, dumb devices that copy every signal out every port. The security statement about the physical layer is simple and severe: anyone who can attach to the medium can read the bits, so the physical layer has no confidentiality of its own. Every protection for the bits must come from above it, from wireless encryption at the data link layer or TLS at the application level. That single fact drives more network security practice than any other.

A compact way to hold the layers is the mnemonic of the PDU chain: data at the top, segment at the transport layer, packet at the network layer, frame at the data link layer, bits at the physical layer. The exam will hand a candidate a protocol and ask which layer it lives at, or hand a device and ask which layer it inspects. The seven-layer table, with its protocols and devices, is the reference answer for both.

The TCP/IP model, and where the exam actually lives

The TCP/IP model compresses the seven OSI layers into four: link, internet, transport, and application. The application layer of TCP/IP absorbs the OSI application, presentation, and session layers. The internet layer is the OSI network layer. The transport layer is the same transport layer. The link layer absorbs the data link and physical layers.

The exam uses both models, and the candidate’s job is not to pick a favorite but to be fluent in the mapping, because questions will name protocols and expect the correct layer in whichever model the question uses. The practical heart of the stack is four names: TCP and UDP at the transport layer, IP at the internet layer, and the application protocols, with HTTP and DNS being the ones the exam favors. TLS sits at the top of the stack, between the transport layer and the application protocol, protecting the application payload end to end, which is what makes HTTPS, the combination of HTTP over TLS on port 443, the default answer whenever a scenario demands confidentiality and integrity in transit.

Encapsulation and the journey down and up

When an application sends a message, the stack does not move the message; it wraps it. The application hands its data to the transport layer, which adds a TCP or UDP header with source and destination ports, producing a segment. The network layer adds an IP header with source and destination addresses, producing a packet. The data link layer adds MAC addresses and a frame check sequence, producing a frame. The physical layer transmits the frame’s bits as signals. This process of wrapping at each layer is encapsulation, and the unwrapping on the receiving side is de-encapsulation, each layer stripping the header its peer added.

Three exam consequences follow. First, the PDU names are layer-specific, and questions love to test them. Second, each header is addressed to the peer layer at the far end: the transport header is read by the destination’s transport layer, the network header by every router, the data link header only by the two devices at each end of a single hop. Third, the content of a packet is opaque to everything below the application layer. A router forwards an encrypted TLS payload without being able to read it, which is why network-layer devices cannot inspect the content of HTTPS sessions and why application-layer devices such as proxies and web application firewalls must terminate or mirror the connection to see inside.

Addresses: the four names a network uses

Every device on a network has several names, each valid at a different layer, and confusion between them causes most of the exam’s address questions.

The MAC address is a 48-bit hardware identifier, usually written as six hexadecimal pairs. It identifies the interface on the local link and has no meaning beyond the segment the device is attached to. MAC addresses can be changed by software on most interfaces, which is called spoofing, and they are not secrets: every frame carries its source MAC in plain sight, so wireless encryption, not MAC filtering, is what actually controls who may use the link.

The IP address identifies the host across the whole internetwork. IPv4 uses 32 bits, written as four decimal octets, and is the address the exam assumes by default. IPv6 uses 128 bits, written as eight groups of four hexadecimal digits, and its defining exam facts are that it restores end-to-end connectivity without NAT, that it makes link-local addresses in the fe80::/10 range automatically available on every interface, and that neighbor discovery, its replacement for ARP, is another thing that must be secured. Both address families use CIDR notation, defined in RFC 4632, in which an address is followed by a slash and the number of bits in the network portion, so 192.168.1.0/24 names a network of 256 addresses.

Three IPv4 address ranges matter on the exam. RFC 1918 defines the private ranges that may not be routed on the public internet: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. The loopback range 127.0.0.0/8 names the local host itself, and the link-local range 169.254.0.0/16, defined in RFC 3927, is what a host assigns itself when it cannot reach a DHCP server. NAT, defined in RFC 3022, maps the private addresses inside a network to one or more public addresses at the edge, and port address translation extends the mapping by multiplexing many private hosts onto one public address using different source ports. NAT is the reason the private ranges work at all on the internet, and it provides a modest and incidental security benefit, hosts behind it are not directly reachable, which the exam treats as a benefit of design, not a control to rely on.

The port number is a 16-bit identifier in the transport header that selects the application within the host. The well-known range, 0 through 1023, holds the standard services: 22 for SSH, 25 for SMTP, 53 for DNS, 80 for HTTP, 110 for POP3, 143 for IMAP, 443 for HTTPS, and 3389 for RDP. DNS also uses TCP port 53 for large transfers, DHCP uses UDP ports 67 and 68, TFTP uses UDP 69, NTP uses UDP 123, and SNMP uses UDP 161. The exam tests ports in pairs: a protocol name with its port, a port with the service that listens on it, and, most often, the rule that the source port of an outbound connection is an ephemeral port chosen by the client while the destination port is the well-known port of the service.

The fourth name is the fully qualified domain name, which DNS, defined in RFC 1035, resolves to an IP address. DNS is the address book of the network and one of the most attacked pieces of infrastructure, because everyone trusts its answers and almost nobody questions them. The defense is DNSSEC, defined across RFC 4033 through 4035, which signs DNS records so resolvers can verify that an answer came from the authoritative source and was not altered in flight. The exam’s DNS facts are modest: what DNS does, that it works over UDP by default, that it is subject to poisoning and hijacking, and that DNSSEC adds authentication and integrity, not confidentiality, because DNS answers are public by design.

The workhorse protocols, understood as behaviors

The protocols the exam actually reasons about, rather than merely names, are a short list: TCP, UDP, ICMP, ARP, DHCP, and DNS.

TCP is worth understanding as a state machine, because stateful firewalls, intrusion detection systems, and SYN flood attacks are all questions about its states. A connection opens with the three-way handshake: the client sends a SYN, the server answers with SYN-ACK, and the client confirms with ACK. Each segment carries a sequence number so the receiver can order what arrives and detect what was lost, and acknowledgments drive retransmission and flow control. The connection closes with a FIN exchange, or is torn down abruptly with a RST. The flags that matter, SYN, ACK, FIN, RST, and PSH, appear constantly in packet descriptions, and the exam expects the candidate to recognize a handshake, a reset, and a scan by their flag patterns.

UDP is the opposite policy: no handshake, no sequence numbers, no retransmission, just a header and a payload. It is chosen for everything where retransmission would hurt more than loss, real-time voice and video, where a late retransmitted frame is worse than a skipped one, and for the small request-response exchanges that are faster without connection setup, DNS, NTP, DHCP, and SNMP. The exam’s UDP question is almost always a match question: which of these applications tolerates loss and therefore uses UDP.

ICMP is the network layer’s messenger. It carries error reports, destination unreachable, time exceeded, and the echo request and reply that make ping work. Its security significance is that it is often firewalled or rate-limited because attackers abuse it, with oversized echo messages historically crashing old stacks, with echo floods saturating links, and with ICMP error messages being used to redirect traffic. ICMP is also a classic covert channel, because arbitrary data can be hidden in its payload fields.

ARP is the glue between the network and data link layers on a single segment. Before a host can send a frame to another host on the same segment, it must know that host’s MAC address, and ARP answers the question: the host broadcasts “who has this IP address?” and the owner replies with its MAC. Because the reply is trusted by default and because ARP has no authentication, any device on the segment can answer for any address, which is ARP poisoning, and the poisoned cache then sends the victim’s traffic to the attacker. The defense is detection plus the fact that ARP poisoning requires being on the segment in the first place.

DHCP, defined in RFC 2131, automates address assignment through the four-message sequence discover, offer, request, acknowledge, which the exam calls DORA. Its security notes are the starvation attack, in which an attacker requests every address in the pool so legitimate hosts cannot get one, and the rogue server, in which an attacker runs a DHCP server that hands out a malicious gateway or DNS address to every host that asks. Port security, DHCP snooping, and 802.1X are the controls that make the segment less hospitable to both.

The devices, and the layer each one inspects

Network security questions are frequently device questions in disguise. The exam describes traffic and asks which device should stand between the traffic and the network, so the device list matters less for its hardware than for what each device sees and what it can do.

A hub, at the physical layer, copies every bit it receives out of every port. Everything attached to a hub can see everything else’s traffic, which makes hubs a sniffing liability and the reason switches replaced them. A switch, at the data link layer, learns which MAC address is reachable through which port and forwards each frame only to the port where the destination lives. The switch’s intelligence is what creates the possibility of a private local conversation, and its failure mode, the MAC flooding attack that overflows its address table and makes it fall back to hub-like flooding, is the attack that recreates the hub problem.

A router, at the network layer, forwards packets between networks by matching the destination IP address against its routing table. The router is the enforcement point for IP-level policy, which is why access control lists that permit or deny by source and destination address and port live there, and why the router at the edge of a network is the natural home of a firewall function.

A firewall is the layer 3 and 4 (and in modern form layer 7) policy engine, and NIST SP 800-41 Rev 1 is the standard reference for the family. Packet-filtering firewalls inspect each packet’s header independently against a rule table: source, destination, port, and protocol, with no memory of the conversation. Stateful firewalls, the overwhelming default today, track the connection state and allow the return traffic of an established conversation without a separate rule, while blocking unsolicited inbound connections. Application proxies and next-generation firewalls terminate or decode the application traffic, TLS-terminating proxies, for example, so the rules can see inside the session. The security trade in every firewall architecture is the same: the deeper the inspection, the more the firewall sees, and the more it becomes a choke point that must be kept patched, tuned, and available, because a failed firewall that drops traffic is a denial of service, and one that fails open is no firewall at all.

An intrusion detection system and an intrusion prevention system, covered by NIST SP 800-94, are the same sensing engine with different plumbing. The detection system receives copies of traffic and alerts on what it finds; the prevention system sits inline and drops the offending traffic. The exam expects the architectural distinction, passive versus inline, and the trade: prevention stops the attack but can drop legitimate traffic on a false positive, while detection preserves availability but depends on someone reading the alerts.

A load balancer distributes connections across a pool of servers. Layer 4 load balancers spread traffic by address and port, and layer 7 load balancers route by application content, the URL path, the host name, or the session cookie. The security note is that the load balancer is a single point of inspection and therefore a natural place to enforce TLS termination, rate limits, and health checks that take failing servers out of rotation.

A proxy is the application’s gateway. A forward proxy sits in front of clients and fetches web content on their behalf, which lets an organization filter, log, and cache what its users request and enforce policy on outbound traffic. A reverse proxy sits in front of servers and represents them to clients, hiding the server architecture, terminating TLS, and performing the functions of a web application firewall, the specialized filter that inspects HTTP traffic for application attacks such as injection and cross-site scripting.

A honeypot is a deliberately exposed decoy, a server or network segment that looks valuable and is instrumented so that any traffic to it is suspicious by definition. It buys the defender early warning and insight into attacker behavior, at the cost of running a system that will be attacked, and the exam treats it as a detection tool, not a protection tool.

Every one of these devices can be placed on the seven-layer chart, and the exam’s device questions reward exactly that placement: hub at layer 1, switch at layer 2, router at layer 3, firewall at layers 3 and 4, and proxy, load balancer, and web application firewall at layer 7 in their application-aware forms.

Segmentation: the map drawn in controlled regions

Segmentation is the network form of least privilege. The principle from Domain 1, that a subject should have only the access it needs, becomes the practice of dividing the network so that a compromise in one region cannot roam freely into another. Segmentation is the answer to more exam scenarios than any other network control, because it is the one that limits blast radius, contains malware, enforces compliance boundaries between systems that must not talk, and turns an any-to-any network into a set of governed flows.

The simplest unit of segmentation is the subnet, a contiguous block of IP addresses that forms one broadcast domain at the data link layer. Devices on the same subnet can reach each other directly at layer 2; devices on different subnets must pass through a router, which is a policy point. That fact, that the router between subnets can filter, is the entire mechanism of network zoning. The exam’s subnetting questions are usually small: how many addresses are in a /24, how many usable hosts a /24 leaves after network and broadcast addresses are removed, and what a given CIDR notation names. The arithmetic is trivial; the skill the exam rewards is reading the notation.

The VLAN, defined by IEEE 802.1Q, extends segmentation below the router. A VLAN is a virtual data link layer network carved out of a switch: frames are tagged with a 12-bit VLAN identifier, and the switch forwards frames only within their VLAN, so broadcast traffic and, more importantly, access to services are contained even when the devices share physical switch hardware. The 12-bit identifier leaves 4094 usable VLANs after the two reserved values. VLANs turn one physical network into many logical networks, which is how a single campus network can carry a public wireless segment, a staff segment, a server segment, and a management segment without separate cabling.

The security notes on VLANs are the VLAN hopping attacks, which the exam names more often than any other 802.1Q fact. Double tagging sends a frame with two 802.1Q tags so the first switch strips the outer tag and forwards the frame with the inner tag, carrying it into a VLAN it was not supposed to reach. Switch spoofing persuades a switch that an attacker’s port is a trunk port, so the attacker sees traffic for every VLAN. The controls are exactly what the exam expects: never use the default VLAN for user traffic, treat trunk ports as controlled infrastructure, and disable unneeded switch features on access ports.

The DMZ, the demilitarized zone, is the classic three-way split: systems that must be reachable from the public internet, the web server, the mail relay, the VPN endpoint, live in a network segment with its own policy, typically between two firewalls or on a third leg of a single firewall, and the internal network is reachable from the DMZ only through rules that permit the specific flows the business needs. The pattern is old and still the default answer to “where does the public web server live”: not on the internal network, and not directly on the internet, but in the segment designed for exposure, with the internal network protected from it.

Two newer forms of segmentation complete the story. Network access control, or NAC, enforces policy at the point of attachment: a device that joins the network must prove its identity and posture, through 802.1X or through agent checks, before it is admitted to the segment its role entitles it to. Microsegmentation takes the idea to its limit, dividing the network down to individual workloads with per-workload policies, which is the mechanism behind the Zero Trust architecture of NIST SP 800-207, where access is granted per session on identity and context rather than per location on the network. And the air gap remains the strongest form of segmentation: a system physically disconnected from every network it must not reach, unbeatable by network attack and purchasable only by accepting that it cannot be updated or managed remotely.

Wireless: the network that cannot be locked in a closet

The wireless LAN, standardized by IEEE 802.11, is the data link layer with the cable removed, and removing the cable changes the security model completely. On a wired network, an attacker who wants to sniff or inject traffic must first get physically onto the segment. On wireless, the medium is the air, so every packet is broadcast to everyone in range, and the only thing that separates an authorized station from an attacker is cryptography. Everything the exam asks about wireless follows from that sentence.

The naming matters. The 802.11 amendments, a through ax, are the standard; the Wi-Fi generations, Wi-Fi 4 through Wi-Fi 6E, are the marketing names; and WEP, WPA, WPA2, and WPA3 are the security schemes layered on the standard. The exam asks about the security schemes almost exclusively, because those are the security decisions. The medium facts worth carrying are the two bands, 2.4 GHz with its three non-overlapping channels 1, 6, and 11, and 5 GHz with more channels and less interference, plus the newer 6 GHz band of Wi-Fi 6E, and the identifiers, the SSID that names the network and the BSSID that names the access point’s radio.

The security history is a sequence of lessons. WEP, the original scheme, encrypted with RC4 using a short key and a 24-bit initialization vector that repeats quickly, so the same key stream came back into service, and an attacker with enough captured frames could recover the key and decrypt everything. WEP is not a cipher choice; it is a broken-by-design warning, and the exam says so in one sentence: never use it. WPA was the interim repair, using TKIP, a keyed RC4 scheme with per-packet keys and a message integrity code, designed to run on old WEP hardware. WPA2, defined with IEEE 802.11i, moved to AES-CCMP, a mode built on AES that provides confidentiality, integrity, and authentication, and was the baseline for years. Its weakness was exposed in 2017 by the KRACK attacks, which exploited the four-way handshake’s key reinstallation, and the fixes shipped as patches plus, eventually, WPA3.

WPA3, introduced by the Wi-Fi Alliance in 2018, changes the fundamentals. In personal mode it replaces the pre-shared key exchange with SAE, the Simultaneous Authentication of Equals, which protects against offline dictionary attacks on weak passphrases and provides forward secrecy. In enterprise mode it requires 802.1X and offers a 192-bit security suite. Protected management frames, which encrypt the management traffic that older networks sent in the clear, are mandatory in WPA3, which closes the deauthentication attack that kicked clients off a network by forging management frames. For the exam, the WPA3 fact to hold is the pair: SAE replaces the handshake that made weak passphrases crackable, and protected management frames close the deauthentication hole.

The other wireless model the exam tests is enterprise authentication. Personal networks authenticate everyone who knows the passphrase; enterprise networks authenticate each user individually through 802.1X, the port-based access control standard, with a supplicant on the client, an authenticator on the access point, and an authentication server, almost always a RADIUS server, defined in RFC 2865. The authentication protocol carried between supplicant and server is EAP, defined in RFC 3748, and the exam distinguishes the EAP methods by their credential types. EAP-TLS, defined in RFC 5216, requires certificates on both sides and is the gold standard for security at the cost of certificate management for every client. EAP-TTLS, defined in RFC 5281, and PEAP protect the conversation in a TLS tunnel and then authenticate the client with a simpler credential, a username and password, inside the tunnel. LEAP, Cisco’s early proprietary method, is broken and appears on the exam only as a lesson. Because enterprise authentication is per user, it removes the shared-passphrase problem entirely, revokes cleanly, and gives the network an audit trail of who was connected when.

The attack list for wireless is short and the exam favors it heavily. A rogue access point is an unauthorized AP attached to the wired network, and its danger is that it invites users to connect through an attacker-controlled radio; the defense is wireless intrusion detection, which scans for APs that are not on the approved list. An evil twin is an AP that imitates a legitimate network’s SSID, often with a stronger signal, so users connect to it and hand over their credentials or traffic. A deauthentication attack forges management frames to disconnect clients, which can then be steered to an evil twin or used to force a client to reveal its handshake. Jamming simply occupies the radio frequency, a physical availability attack against the medium itself, which is why wireless denial of service is so hard to defend against. The controls that matter are the ones the exam always returns to: encrypt the link, authenticate the stations, detect the rogues, and treat the wireless network as a hostile segment even when it is the organization’s own.

The attack classes in one sweep

The next chapter pairs each network attack with its countermeasure in detail. This chapter’s job is the overview, the map of what can go wrong, because the architecture chapters have to name the problem before the countermeasure chapter can fix it. Four classes cover almost everything.

Interception is the attacker reading traffic they should not read. The tools are sniffing, passively capturing frames on the wire or the air, and the man-in-the-middle, actively standing between two parties and relaying their traffic while reading or altering it. The countermeasures are the theme of the whole domain: encryption in transit, authentication of endpoints, and segmentation that keeps the attacker off the segment where the traffic flows.

Modification is the attacker changing traffic in flight, or pretending to be someone else so that changes are accepted. Spoofing covers the impersonations: IP spoofing to hide or forge a source address, MAC spoofing to impersonate a device on the local link, ARP poisoning to make the segment itself deliver the victim’s traffic to the attacker, and DNS poisoning to make name resolution deliver the wrong server. Session hijacking takes over an established connection, and replay sends a captured message again to get the same effect a second time. These attacks all have the same shape, a trust assumption in a protocol that does not authenticate, and the countermeasure family is authentication, integrity checking, and unpredictable tokens such as fresh session identifiers.

Interruption is the attacker making service unavailable. The denial of service family includes the SYN flood, which fills the server’s half-open connection queue with handshakes that never complete; the amplification attack, which uses a small request to a big-responding service, DNS and NTP being the classic examples, with a spoofed victim address, so the victim is deluged by responses it never asked for; and the distributed versions, in which thousands of compromised devices flood the target at once. The defense family is the availability toolkit: rate limiting, filtering of spoofed sources, capacity that absorbs attacks, and the architecture of the previous section, which contains the damage.

Fabrication is the attacker creating traffic or identities that were never authorized, the fake server, the forged error, the invented connection, and it is often just the enabler of one of the other three, as the evil twin enables interception. The countermeasure is authentication at every layer that matters, which is why the exam’s network story ends where the identity story of Domain 5 begins.

How the exam thinks about this material

Domain 4 questions reward three habits. The first is placing things: when the stem mentions a protocol, name its layer and its job; when it mentions a device, name what that device inspects and what it adds over the device below it; when it mentions a PDU, name its layer. Most wrong answers in network questions are wrong because they place the correct protocol at the wrong layer or the correct concept in the wrong device.

The second habit is reading the medium. A scenario in a wired office, a scenario in a café on wireless, and a scenario across the public internet have different attacker models, and the exam’s correct answers follow the model. On the local segment, the attacks are ARP poisoning, MAC flooding, and sniffing. On wireless, they are rogue access points, evil twins, and handshake attacks. Across the internet, they are spoofing, hijacking, and denial of service. The candidate who asks “where does this attacker sit?” before choosing the answer is already most of the way there.

The third habit is remembering that the manager view from Chapter 2 still applies. Network security answers are rarely “buy a bigger firewall”; they are “segment the network, authenticate the endpoints, encrypt the links, and detect the intrusion”, the controls that reduce blast radius and make the compromise recoverable. The exam’s network questions reward knowing which control a scenario calls for, and the architecture in this chapter is the vocabulary for that judgment.

Practice questions

1. A network engineer explains that a switch forwards each frame only out the port where the destination’s MAC address has been learned. At which OSI layer does this device operate?

A. Physical B. Data link C. Network D. Transport

2. An application sends a message through the protocol stack. In order, the message gains a transport header, then a network header, then a data link header. Which PDU names, in order, describe the message at those three stages?

A. Segment, packet, frame B. Packet, segment, frame C. Frame, packet, segment D. Segment, datagram, cell

3. A streaming video service sends frames that must arrive continuously, and a frame that arrives late is useless even if it is retransmitted correctly. Which transport protocol fits, and why?

A. TCP, because it guarantees ordered delivery B. UDP, because it has no retransmission or ordering overhead C. TCP, because it provides flow control D. UDP, because it encrypts the payload

4. A user types a host name, and the browser asks a server to translate it into an IP address. Which protocol performs this translation, and which standard defines it?

A. ARP, RFC 826 B. DHCP, RFC 2131 C. DNS, RFC 1035 D. ICMP, RFC 792

5. Before a host can send a frame to another host on the same segment, it must learn that host’s data link address from its IP address. Which protocol performs this resolution?

A. DNS B. ARP C. ICMP D. DHCP

6. A client opens a TCP connection. In which order do the flags of the three-way handshake appear?

A. SYN, ACK, SYN-ACK B. SYN, SYN-ACK, ACK C. ACK, SYN, FIN D. SYN, FIN, ACK

7. Which statement correctly describes ICMP?

A. It carries error reports and echo messages used by ping, and attackers abuse it for floods and covert channels B. It resolves names to addresses C. It guarantees delivery of application data D. It encrypts traffic between two hosts

8. An organization must place a public web server that the internet must reach. The server must not be able to initiate arbitrary connections into the internal network. Where does it belong?

A. On the internal network behind the same rules as internal servers B. In a demilitarized zone with specific inbound and outbound rules C. Directly on the internet with no firewall D. On the same segment as the VPN endpoints and no other policy

9. A firewall remembers which connections are established and allows return traffic for them while blocking unsolicited inbound connections. What is this firewall called?

A. A packet-filtering firewall B. A stateful inspection firewall C. A proxy firewall D. A host-based firewall

10. A switch administrator wants to keep broadcast traffic and access between departments separate on one physical switch. Which mechanism does this directly?

A. NAT B. A VLAN, defined by IEEE 802.1Q C. DNSSEC D. A subnet with the same addressing on both departments

11. Which address range is NOT defined as a private range by RFC 1918?

A. 10.0.0.0/8 B. 172.16.0.0/12 C. 192.168.0.0/16 D. 169.254.0.0/16

12. Which statement about IPv6 is correct?

A. It uses 32-bit addresses and requires NAT B. It uses 128-bit addresses, restores end-to-end connectivity, and assigns link-local addresses automatically in fe80::/10 C. It is defined in RFC 791 D. It uses ARP exactly as IPv4 does

13. A DHCP starvation attack is underway: an attacker requests every address in the pool so legitimate hosts receive nothing. Which control prevents the attack at the switch rather than at the server?

A. DNSSEC B. DHCP snooping C. WPA3 D. NAT

14. An attacker sends a frame with two 802.1Q tags so that the first switch strips the outer tag and forwards the inner tag, carrying the frame into a VLAN it should not reach. What is this attack called?

A. VLAN hopping by double tagging B. MAC flooding C. ARP poisoning D. DHCP starvation

15. An organization’s clients authenticate individually to the wireless network, each proving their identity to a RADIUS server through an access point. Which standard provides this port-based access control?

A. IEEE 802.11i B. IEEE 802.1X C. IEEE 802.3 D. RFC 1918

16. Which wireless security scheme is broken by design because its RC4 encryption reuses initialization vectors, allowing an attacker to recover the key from captured traffic?

A. WPA2 with AES-CCMP B. WPA3 with SAE C. WEP D. TKIP

17. What does WPA3 change about personal-mode authentication compared with WPA2?

A. It removes encryption and relies on network hiding B. It replaces the pre-shared key handshake with SAE, which resists offline dictionary attacks, and requires protected management frames C. It uses WEP encryption for compatibility D. It requires each user to use the same passphrase

18. A rogue access point appears on the wired network, inviting users to connect through an attacker-controlled radio. Which control is designed to detect it?

A. Wireless intrusion detection that scans for unauthorized access points B. MAC filtering on the access points C. WPA3 enterprise mode D. Channel selection

19. An attacker operates an access point broadcasting the same SSID as the legitimate network, with a stronger signal, and users connect to it and enter their credentials. What is this attack called?

A. A deauthentication attack B. An evil twin C. A SYN flood D. A MAC spoof

20. An attacker sends frames with random source MAC addresses until the switch’s address table overflows, and the switch then floods frames out of every port like a hub. What does the attacker gain?

A. The ability to sniff traffic on the segment B. The switch’s routing table C. The DHCP pool D. The VLAN identifier of every trunk

21. On a shared segment, an attacker answers every ARP request with its own MAC address so the victim’s traffic is delivered to the attacker first. What is this attack called, and what does it enable?

A. DNS poisoning, enabling name interception B. ARP poisoning, enabling a man-in-the-middle position C. MAC flooding, enabling sniffing D. Replay, enabling session forgery

22. Which statement about DNSSEC is correct?

A. It encrypts DNS answers so eavesdroppers cannot read them B. It provides authentication and integrity for DNS answers, but not confidentiality C. It replaces DNS with a new protocol D. It prevents denial of service against DNS servers

23. An attacker sends small DNS queries with a victim’s spoofed source address to open resolvers, which respond with large answers, flooding the victim. Which fact makes this attack effective?

A. The resolver encrypts its answers B. The responses are much larger than the queries, and the source is spoofed so responses go to the victim C. DNS queries require TCP connections D. The resolvers authenticate the victim

24. A server receives thousands of SYN segments that start handshakes that are never completed, until its connection queue is full and legitimate clients cannot connect. What resource is being exhausted, and what is a common mitigation?

A. The ARP cache; ARP spoofing B. The half-open connection queue; SYN cookies C. The DHCP pool; DHCP snooping D. The DNS cache; DNSSEC

25. A reverse proxy inspects HTTP requests, filters application attacks such as injection, and passes clean traffic to the web server behind it. At which OSI layer does this filtering occur?

A. Physical B. Network C. Transport D. Application

Answers and rationales

1. B. A switch learns MAC addresses and forwards frames by destination MAC, which is the data link layer’s job. Hubs and repeaters sit at the physical layer (option A), routers forward by IP address at the network layer (option C), and the transport layer carries segments, not frames, and is where TCP and UDP live (option D).

2. A. The transport layer adds its header and produces a segment, the network layer wraps it as a packet, and the data link layer wraps it as a frame, so the three names in order are segment, packet, frame. The other orders reverse or mislabel the stages (options B, C, and D).

3. B. UDP is connectionless and does not retransmit or reorder, which is exactly right for real-time media where a late frame is worthless. TCP’s reliability guarantees, ordered delivery and retransmission (options A and C), work against real-time streaming, and UDP provides no encryption (option D), which is handled by other layers such as TLS or wireless encryption.

4. C. DNS, defined in RFC 1035, resolves names to IP addresses. ARP resolves IP addresses to MAC addresses on the local segment (option A), DHCP assigns addresses and other configuration (option B), and ICMP carries errors and echo messages (option D).

5. B. ARP, defined in RFC 826, resolves an IP address to a MAC address on the local segment, which is what a host needs before it can build the frame. DNS resolves names to IP addresses (option A), ICMP carries control messages (option C), and DHCP assigns addresses (option D).

6. B. The three-way handshake is SYN from the client, SYN-ACK from the server, then ACK from the client. The other orders describe flag sequences that are not the handshake (options A, C, and D).

7. A. ICMP, defined in RFC 792, carries error reports and the echo request and reply used by ping. Attackers abuse it with floods and by hiding data in its payload as a covert channel. It does not resolve names (option B), does not guarantee delivery (option C), and provides no encryption (option D).

8. B. A public web server belongs in a demilitarized zone with rules that permit the specific inbound and outbound flows it needs, so a compromise of the server does not hand the attacker the internal network. Putting it on the internal network (option A) exposes the interior, placing it with no firewall (option C) is an unmanaged exposure, and placing it with VPN endpoints and no other policy (option D) invites the server to become a pivot into the VPN traffic.

9. B. A stateful inspection firewall tracks connection state and permits return traffic of established conversations while blocking unsolicited inbound connections. Packet-filtering firewalls evaluate each packet without connection memory (option A), proxy firewalls terminate and relay application connections (option C), and host-based firewalls protect one host rather than the network edge (option D).

10. B. A VLAN, tagged per IEEE 802.1Q, separates broadcast domains and access on one physical switch. NAT maps address ranges (option A), DNSSEC protects name resolution (option C), and a subnet with the same addressing on both departments (option D) does not create two separate networks; it creates confusion.

11. D. RFC 1918 defines 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 as private. The 169.254.0.0/16 range is link-local, defined in RFC 3927, and is what a host assigns itself when no DHCP server answers.

12. B. IPv6, defined in RFC 8200, uses 128-bit addresses, restores end-to-end connectivity without NAT, and gives every interface an automatic link-local address in fe80::/10. It does not use 32 bits or require NAT (option A), is not defined in RFC 791 (option C), and replaces ARP with neighbor discovery (option D).

13. B. DHCP snooping inspects DHCP traffic at the switch, builds a trust boundary between trusted and untrusted ports, and drops requests that would exhaust the pool. DNSSEC protects name resolution (option A), WPA3 protects wireless links (option C), and NAT maps addresses (option D).

14. A. Double tagging is the VLAN hopping technique where a second 802.1Q tag carries the frame into a VLAN the sender should not reach. MAC flooding overflows the switch’s address table (option B), ARP poisoning corrupts address caches (option C), and DHCP starvation exhausts address pools (option D).

15. B. IEEE 802.1X is the port-based access control standard that gates access at the switch or access point through a supplicant, an authenticator, and an authentication server such as RADIUS. IEEE 802.11i defines the WPA2 security scheme (option A), IEEE 802.3 is Ethernet (option C), and RFC 1918 is private addressing (option D).

16. C. WEP is broken by design: its RC4 encryption and short 24-bit initialization vector reuse key streams, so captured traffic eventually reveals the key. WPA2’s AES-CCMP and WPA3’s SAE are the later, sound schemes (options A and B), and TKIP, the interim WPA scheme, was designed to fix WEP’s weaknesses rather than being the broken original (option D).

17. B. WPA3 replaces the pre-shared key handshake with SAE, which resists offline dictionary attacks on weak passphrases and provides forward secrecy, and it makes protected management frames mandatory. It does not remove encryption (option A), does not use WEP (option C), and while personal mode still uses a passphrase, the security does not rest on its strength alone as it did before (option D).

18. A. Wireless intrusion detection continuously scans the airwaves for access points that are not on the approved list, which is the designed detection control for rogue APs. MAC filtering (option B) controls who may join, not what APs exist, WPA3 enterprise mode (option C) authenticates users, and channel selection (option D) is a performance matter.

19. B. An evil twin is an access point impersonating a legitimate network’s SSID, usually with a stronger signal, to capture credentials and traffic. A deauthentication attack disconnects clients (option A), a SYN flood exhausts connection queues (option C), and a MAC spoof impersonates a hardware address (option D).

20. A. When the switch’s address table overflows, the switch can no longer forward selectively and floods frames out of every port, recreating the hub behavior that lets the attacker sniff the segment. The attack does not expose the routing table (option B), the DHCP pool (option C), or trunk VLAN identifiers (option D).

21. B. In ARP poisoning, the attacker answers ARP requests for other hosts with its own MAC, so the victim sends frames to the attacker, which relays them onward, a man-in-the-middle position on the local segment. DNS poisoning corrupts name resolution (option A), MAC flooding overwhelms the switch (option C), and replay resends captured messages (option D).

22. B. DNSSEC, defined in RFC 4033 through 4035, signs DNS records so resolvers can verify authenticity and integrity. DNS answers are public by design, so DNSSEC provides no confidentiality (option A), it extends rather than replaces DNS (option C), and it does not address denial of service against the servers themselves (option D).

23. B. Amplification works because the response is many times larger than the query, and because the attacker spoofs the victim’s source address, the large responses are delivered to the victim. Encryption of answers (option A) is irrelevant to the mechanism, DNS queries normally use UDP rather than TCP (option C), and open resolvers do not authenticate the victim (option D).

24. B. A SYN flood exhausts the half-open connection queue with handshakes that never complete, and SYN cookies are a common mitigation because the server encodes the connection state in its response instead of holding resources. ARP cache, DHCP pool, and DNS cache are different resources defended by different controls (options A, C, and D).

25. D. A reverse proxy and web application firewall inspect HTTP, the application protocol, and filter application-layer attacks, so the filtering occurs at the application layer. The physical, network, and transport layers (options A, B, and C) carry the traffic but do not understand the HTTP content the filter examines.

Network architectures on one page

Layering is the division of labor: the application layer speaks protocols such as HTTP and DNS, the transport layer carries segments on TCP or UDP with ports, the network layer forwards packets by IP address through routers, the data link layer moves frames between neighbors by MAC address through switches, and the physical layer transmits bits that carry no confidentiality of their own. The PDU chain, data, segment, packet, frame, bits, is the exam’s favorite placement question, and the address chain, FQDN, IP, port, MAC, is its favorite matching question. IPv4 private space is RFC 1918, NAT is RFC 3022, and IPv6, RFC 8200, restores end-to-end connectivity and automatic link-local addresses.

Devices are layer questions: hubs at layer 1, switches at layer 2, routers at layer 3, firewalls from packet filter through stateful inspection to application proxy per NIST SP 800-41, IDS and IPS as passive and inline engines per NIST SP 800-94, and proxies, load balancers, and web application firewalls at layer 7. Segmentation is least privilege for the network: subnets, VLANs per IEEE 802.1Q with their double-tagging attack, DMZs for anything public, NAC at the point of attachment, microsegmentation per workload as NIST SP 800-207 requires, and the air gap as the ultimate boundary.

Wireless moved the link into the air, so cryptography is the whole security story: WEP is broken by IV reuse, WPA2 brings AES-CCMP per IEEE 802.11i, WPA3 replaces the handshake with SAE and mandates protected management frames, and the enterprise model of 802.1X with EAP, EAP-TLS, and RADIUS authenticates each user instead of a shared passphrase. The attack map is interception, modification, interruption, and fabrication, from sniffing and ARP poisoning on the segment to evil twins on the air and SYN floods and amplification across the internet, and the next chapter answers every one of them with its countermeasure.