Networking Fundamentals Exam

Handwritten Notes

SECTION A: Knowledge & Understanding

Question 1: Network Layer Processes

The Network Layer (Layer 3) performs four essential processes:

• Addressing: Assigns logical IP addresses to devices, creating a hierarchical
addressing scheme that identifies both the network and the host. This allows
devices to be located across different networks.
• Routing: Determines the optimal path for data to travel from source to destination
across multiple networks. Routers use routing protocols (like OSPF or RIP) and
maintain routing tables to make these decisions.
• Encapsulation: Takes the segment (Layer 4 PDU) and adds an IP header containing
source and destination IP addresses, creating a packet. This header also includes
control information like TTL and protocol type.
• Forwarding: The actual movement of packets from a router's incoming interface to
the appropriate outgoing interface based on the routing table, directing the packet
toward its next hop.

Question 2: IPv4 Header Fields

Five significant fields in an IPv4 header:

• Version (4 bits): Indicates IP version (always 0100 for IPv4), allowing devices to
correctly interpret the header.
• Source IP Address (32 bits): The logical address of the packet's originator.
• Destination IP Address (32 bits): The logical address of the packet's intended
recipient.
• Time-to-Live (TTL) (8 bits): Prevents routing loops by decrementing at each hop;
 when TTL reaches 0, the packet is discarded and an ICMP message is sent to the
source.
• Protocol (8 bits): Identifies the transport layer protocol (e.g., 6 for TCP, 17 for UDP)
so the destination knows how to process the data payload.

Question 3: Ethernet MAC Address Structure

A MAC address is a 48-bit (6-byte) physical address burned into the NIC ROM:
• Format: Typically written as 12 hexadecimal digits, often grouped in pairs or quads
(e.g., 00:1A:2B:3C:4D:5E or 001A.2B3C.4D5E).
• OUI (Organizationally Unique Identifier): The first 24 bits (first 6 hex digits) are
assigned by IEEE to the manufacturer (e.g., Cisco, Intel). This ensures vendor
identification.
• Device Identifier: The last 24 bits (last 6 hex digits) are uniquely assigned by the
manufacturer to that specific interface, ensuring global uniqueness of the full
address.

Question 4: ARP Functions and Process

Two Basic Functions of ARP:

• Address Resolution: Dynamically discovers the MAC address associated with a

known IPv4 address on the same local network.
• Cache Management: Maintains a table (ARP cache) of resolved IP-to-MAC mappings
to reduce broadcast traffic.

Process When MAC Address Unknown:

→ The device creates an ARP request containing its own MAC/IP and the target IP, with
target MAC set to 00:00:00:00:00:00.
→ It encapsulates this in an Ethernet frame with destination MAC FF:FF:FF:FF:FF:FF
(broadcast) and sends it out all ports.
→ All devices on the LAN receive the frame; the device with matching target IP
processes it.
→ The target device sends a unicast ARP reply directly back, containing its MAC
address.
 → The original device updates its ARP cache with the new mapping and can now send
data.

Question 5: Bandwidth, Throughput, and Goodput

• Bandwidth: The theoretical maximum data transfer capacity of a network link,

typically stated in bits per second (e.g., 100 Mbps, 1 Gbps). It represents the ideal
capacity under perfect conditions.
• Throughput: The actual measured data transfer rate achieved over a link, usually
lower than bandwidth due to factors like congestion, latency, and hardware
limitations.
• Goodput: The application-level throughput - the rate of useful data excluding all
protocol overhead (headers, acknowledgments, retransmissions). This is what the
user actually experiences.
Mathematical Relationship: Bandwidth >= Throughput >= Goodput
Goodput = Throughput - (Protocol Overhead + Retransmissions)

Question 6: Switching Methods Comparison

Store-and-Forward Switching:

Receives the entire frame into memory, performs CRC error checking, then forwards if
valid.
Advantage: Discards corrupt frames, preventing error propagation and saving
bandwidth.

Cut-Through Switching:

Begins forwarding as soon as the destination MAC address is read (first 6 bytes after
preamble), reducing latency.
Two Variants:
• Fast-forward: Immediately forwards after reading dest MAC (lowest latency, no error
checking).
• Fragment-free: Waits for first 64 bytes (collision window) before forwarding, filtering
out most collision fragments.
Question 7: Cisco IOS Access Modes

User EXEC Mode:

Prompt: Router>
Operations: Limited monitoring commands (e.g., ping, traceroute, show basic status).
Cannot view or change configuration.

Privileged EXEC Mode:

Prompt: Router#
Operations: Full device monitoring, debugging, file management, and access to
configuration modes. Entered via enable command.

Global Configuration Mode:

Prompt: Router(config)#
Operations: System-wide configuration changes (hostname, passwords, routing
protocols). Entered via configure terminal from privileged mode.

SECTION B: Application & Case Studies

Question 8: Router Hardening

(a) Configuration Commands:

enable
configure terminal
hostname Branch1
enable secret Admin$123
line console 0
password Con$ecure
login
exit
line vty 0 4
transport input ssh
password Rem0te99
login
exit
 service password-encryption
banner motd #Unauthorized access prohibited. Legal warning.#
end
copy running-config startup-config

(b) Copy Command Explanation:

The command copy running-config startup-config saves the currently active

configuration (in RAM) to NVRAM as the startup configuration. This is critical because
the running-config is volatile - it would be lost if the router reboots or loses power.
Saving to startup-config ensures the configuration persists and loads automatically on
next boot.

Question 9: IPv4 Exhaustion at ISP

(a) IPv4 Limitations Corresponding to Problems:

• Running out of public addresses: IPv4's 32-bit address space provides only ~4.3
billion addresses, insufficient for modern device growth.
• Large routing tables: Classful addressing and lack of efficient summarization lead to
routing table bloat.
• NAT issues with real-time apps: NAT modifies IP addresses/ports, breaking protocols
that embed IP information in payload (e.g., VoIP, some VPNs) and adding latency.

(b) How IPv6 Resolves Each Problem:

• Address exhaustion: 128-bit addressing provides 3.4x10^38 addresses - practically

unlimited, allowing every device to have a unique public address.
• Routing table size: Hierarchical addressing and route aggregation (summarization)
keep routing tables manageable.
• NAT issues: IPv6 restores end-to-end connectivity without NAT, eliminating
application-layer problems and reducing latency.

(c) Address Size:

IPv4: 32 bits (4.29x10^9 addresses)

IPv6: 128 bits (3.4x10^38 addresses)
Why IPv6 is practically unlimited: The address space is astronomically large - enough
to assign billions of addresses to every square millimeter of Earth's surface.
Question 10: ARP Poisoning Attack

(a) Technical Vulnerability:

ARP is stateless - devices accept ARP replies even without sending a corresponding
request. Attackers can send unsolicited ARP replies (gratuitous ARP) claiming to own a
target IP (like the default gateway). When victims update their ARP caches with this
false information, traffic intended for the gateway is sent to the attacker instead.

(b) Two Consequences:

• Man-in-the-Middle (MITM): Attacker intercepts traffic between victims and gateway,

capturing sensitive data (passwords, financial info).
• Denial of Service (DoS): Attacker can drop all intercepted traffic, disrupting network
connectivity for victims.

(c) Enterprise Mitigation:

Dynamic ARP Inspection (DAI) on switches validates ARP packets against a trusted
DHCP snooping binding table, dropping invalid ARP replies and preventing spoofing.

Question 11: New Switch Deployment

(a) First Frame from PC-A to PC-D:

→ Switch receives frame on port connected to PC-A.

→ It learns: PC-A's MAC address is now associated with that incoming port (adds to
MAC table).
→ It checks MAC table for PC-D's MAC address - table is empty (unknown).
→ Switch floods the frame out all ports except the incoming port (PC-A's port).
→ PC-D receives and processes the frame; other PCs discard it (not destined for
them).

(b) PC-B Replaced with New Machine:

When the new PC-B sends its first frame:

→ Switch receives frame on the same port as before.
 → It examines source MAC address (now a new address).
→ It updates its MAC address table, replacing the old MAC entry with the new MAC
address for that specific port.
This ensures the switch maintains accurate forwarding information without manual
intervention.

(c) Default Aging Time and Purpose:

Default time: 300 seconds (5 minutes).

Purpose: The aging timer removes stale entries when devices are disconnected,
moved, or powered off. This prevents the switch from forwarding frames to inactive
ports and frees table space for active devices. If a device becomes active again, the
switch relearns its MAC address dynamically.

Question 12: Designing an Addressing Scheme

(a) Why Flat Addressing is Impractical:

Flat addressing (like MAC addresses) has no structure - every address is unique but
contains no location information. In a large network like the Internet, routers would
need to maintain an entry for every single device (billions of entries), making routing
tables impossibly large and updates unmanageable. Every time any device joined or
left, all routers worldwide would need to update their tables.

(b) Telephone Numbering Analogy:

Hierarchical IP addressing works like international phone numbers:

• Country code: Identifies the major network (like the /8 prefix identifying a large
region).
• Area code: Identifies a specific network within that region (like a /16 subnet).
• Local number: Identifies the specific device (host portion).
This hierarchy allows routers to make forwarding decisions based only on the network
portion (country+area code), ignoring the local details. Routers only need routes to
networks, not individual hosts, drastically reducing table size.

(c) CIDR Definition and Improvement:

CIDR: Classless Inter-Domain Routing.

 Improvement over classful addressing: CIDR allows variable-length subnet masks
(VLSM), enabling networks to be divided into arbitrarily sized subnets rather than
being locked into /8, /16, or /24 sizes. This enables route aggregation (supernetting),
where multiple contiguous networks can be advertised as a single route, further
reducing routing table size.

Question 13: Troubleshooting Interface Connectivity

(a) Two Problems in show ip interface brief Output:

GigabitEthernet0/0/0: Status "down", Protocol "down"

Likely cause: Physical layer problem - cable unplugged, faulty cable, or connected
device powered off. Both layers down indicates no physical connectivity.
GigabitEthernet0/0/1: Status "admin down", Protocol "down"
Likely cause: Interface manually disabled by administrator (shutdown command). The
"admin down" explicitly indicates administrative action.

(b) Fix Commands:

configure terminal
interface gigabitEthernet0/0/0
no shutdown
ipv6 address 2001:db8:acad:10::1/64
exit

(c) Verification Command:

show ip interface brief
show ipv6 interface brief
Or combined with: show interfaces description or show ipv6 interface
gigabitEthernet0/0/0

Question 14: Office Network Cabling Problems

(a) Physical Layer Problems and Mitigation:

Finding Physical Layer Mitigation Principle

Problem

UTP runs exceed 120 Attenuation (signal Follow distance

metres weakening over specifications (100m
 distance), causing bit max for Ethernet UTP)
errors and loss

Cables parallel to Electromagnetic Maintain separation

fluorescent lights Interference (EMI) from EMI sources (at
from ballasts inducing least 30cm)
noise

Cable pairs unwound NEXT (Near-End Preserve twist rate

near terminations Crosstalk) - signal right up to termination
coupling between point
wires

(b) Principle of Cancellation in UTP:

In twisted pair cabling, the two wires in each pair are twisted together. EMI affects
both wires equally (common-mode noise). The receiving device uses differential
signaling - it reads the difference between the two wires. Since noise is identical on
both, it cancels out, leaving the original signal intact. The twisting ensures both wires
experience the same interference, enabling this cancellation.

Question 15: IPv6 Deployment

(a) ARP Replacement in IPv6:

Protocol: Neighbor Discovery (ND) Protocol (part of ICMPv6).

ICMPv6 Message Types: Neighbor Solicitation (NS) and Neighbor Advertisement (NA).

(b) IPv6 Address Resolution Process:

→ Host-A needs Host-B's MAC address for IPv6 address on same link.
→ Host-A creates a Neighbor Solicitation (NS) message containing Host-B's IPv6
address and Host-A's own MAC/link-layer address.
→ The NS is sent to a special solicited-node multicast address derived from Host-B's
IPv6 address (not broadcast).
→ All IPv6 devices on the LAN listen to their solicited-node multicast groups. Only
Host-B (and possibly a few others) receive the NS.
→ Host-B responds with a unicast Neighbor Advertisement (NA) directly to Host-A,
containing its MAC address.
→ Host-A updates its Neighbor Cache (similar to ARP cache) with the mapping.
(c) Two Other ND Protocol Services:

• Router Discovery: Hosts can discover local routers and learn prefixes for
autonomous address configuration.
• Stateless Address Autoconfiguration (SLAAC): Hosts automatically generate their
own IPv6 addresses using router-advertised prefixes.
• Duplicate Address Detection (DAD): Hosts verify that an address is unique on the
link before assigning it.
• Redirect: Routers can inform hosts of a better first-hop router for specific
destinations.

Question 16: Cross-Network Communication

(a) Destination MAC Address in PC1's Frame:

PC1 puts the MAC address of its default gateway (router) in the destination MAC field.
Since the web server ([Link]) is on a different network, PC1 knows it cannot
reach it directly at Layer 2. The frame is addressed to the router, which will forward it
toward the Internet.

(b) Role of ARP Before Sending:

Before PC1 can send the frame, it must know the router's MAC address. PC1 checks its
ARP cache for [Link] (gateway). If not present, it sends an ARP broadcast
request: "Who has [Link]?" The router responds with its MAC address. Only after
receiving this reply can PC1 construct the frame with the correct destination MAC.

(c) What the Router Does:

Layer 2 (Frame) Processing: Router receives the frame, verifies FCS, and sees the
destination MAC matches its own interface. It decapsulates (removes) the Ethernet
frame.
Layer 3 (Packet) Processing: Router examines the destination IP ([Link]). It
consults its routing table to find the best path (likely toward the Internet).
Re-encapsulation: Router determines the next-hop device and outgoing interface. It
creates a new Ethernet frame with:
• Source MAC: Its own outgoing interface MAC.
• Destination MAC: MAC of the next-hop router (or final server if directly connected).
 Forwarding: Sends the new frame out the appropriate interface toward the
destination.

SECTION C: Short Answer

Question 17: Three Characteristics of IP Protocol for Low Overhead

• Connectionless: No handshake or connection setup before sending data, eliminating

control message overhead.
• Best-Effort Delivery: No built-in mechanisms for reliability (retransmission,
acknowledgment, sequencing), reducing header complexity and processing.
• Stateless: Each packet is treated independently; no state information about sessions
is maintained, simplifying router design and reducing memory usage.

Question 18: Duplex Mismatch

Definition: A condition where one link partner operates in full-duplex (transmit/receive

simultaneously) while the other operates in half-duplex (only one direction at a time).
Cause: Typically occurs when one side is manually set and the other uses
autonegotiation, or when autonegotiation fails.
Symptoms: Severe performance degradation, collisions, CRC errors on the half-duplex
side, and slow throughput.
Best Practice to Prevent: Always use autonegotiation on both sides for speed and
duplex. Only manually set when absolutely necessary and on both ends identically.

Question 19: Ethernet Frame Sizes

Minimum valid size: 64 bytes (from destination MAC through FCS).

Maximum valid size: 1518 bytes (standard Ethernet) or 1522 bytes (with 802.1Q VLAN
tag).
Frames outside limits:
• Runt: Frames smaller than 64 bytes, discarded by receiving devices.
 • Jabber/Giant: Frames larger than maximum, discarded (considered errors).
Purpose of limits: Ensures fair access (collision detection) and prevents one station
from monopolizing the medium.

Question 20: Console Access vs SSH Access

Console Access: Physical connection via console cable to the device's console port.
Used for initial configuration, password recovery, and out-of-band management.
Requires physical proximity.
SSH Access: Secure, encrypted remote access over the network. Provides
authentication and encryption.
Recommended for remote access: SSH.
Why Telnet is discouraged: Telnet sends all data, including usernames and passwords,
in plaintext (unencrypted), making it vulnerable to interception by anyone on the
network path.

Question 21: Unicast, Broadcast, and Multicast MAC Addresses

• Unicast: Identifies a single specific NIC. First octet's least significant bit (I/G bit) = 0.
Example: 00:1A:2B:3C:4D:5E.
• Broadcast: Delivered to all devices on the local network. All 48 bits are 1s:
FF:FF:FF:FF:FF:FF.
• Multicast: Delivered to a group of devices that subscribe to the multicast group. First
octet's least significant bit = 1. Example: IPv4 multicast maps to 01:00:5E: prefix.

Question 22: Physical Layer Encoding

Definition: Encoding is the process of converting digital data (bits) into signals that
can be transmitted over the physical medium (electrical voltages, light pulses, radio
waves).
Example: Manchester Encoding (in older Ethernet) represents each bit by a voltage
transition (low-to-high = 0, high-to-low = 1). 4B/5B (Fast Ethernet) maps 4-bit data to
5-bit code for control symbols and clock synchronization.
Why necessary: Encoding ensures clock synchronization between sender/receiver,
 provides signal transitions for timing recovery, and can add error detection or DC
balancing.

Question 23: Auto-MDIX

What it is: Auto Medium-Dependent Interface Crossover. A feature on modern switch

and router ports that automatically detects whether a straight-through or crossover
cable is needed and internally adjusts the transmit/receive pairs accordingly.
Problem it solves: Eliminates the need for crossover cables when connecting similar
devices (switch to switch, switch to router). Allows any cable type to work for any
connection.
Should administrators rely on auto-MDIX alone? Generally yes on modern equipment,
but not exclusively for troubleshooting. In older networks or when connecting to non-
compliant devices, understanding proper cable types is still important. Best practice:
use correct cable type first, but appreciate auto-MDIX as a backup.

Question 24: Host Routing Table vs Router Routing Table Differences

• Size/Complexity: Host tables are typically small (default gateway, local network,
loopback). Router tables can be massive (thousands of routes) and are dynamically
updated via routing protocols.
• Purpose/Function: Host tables are used to decide whether to send traffic to the
default gateway or directly to a local destination. Router tables determine the
exact next-hop path across multiple networks toward any destination.
• Source of Entries: Host entries are mostly derived from DHCP and static
configuration. Router entries come from static configuration, directly connected
networks, and dynamic routing protocols (OSPF, EIGRP, BGP).

Question 25: Port-Based vs Shared Memory Buffering

Port-Based Memory Buffering: Frames are stored in queues dedicated to specific

output ports before transmission. Frames for a congested port fill that port's queue,
potentially causing drops even if other ports are idle.
Shared Memory Buffering: All ports share a common memory pool. Frames are
dynamically allocated buffer space as needed. A single congested port can use more
buffer space without starving other ports.
Advantage of Shared Memory Buffering: More efficient use of total memory resources.
Can allocate larger buffers to congested ports while allowing idle ports to free up
memory, reducing overall packet loss and improving performance under variable
traffic patterns.