1. Explain the responsibilities of all seven layers of the OSI model.

7. Application Network services used by applications - HTTP, DNS, SMTP

6. Presentation Translation, compression and encryption of data

5. Session Establishes, manages and terminates communication sessions

4. Transport End-to-end delivery, segmentation, reliability and flow control

3. Network Logical addressing and routing of packets between networks

2. Data Link Framing, MAC addressing, local delivery and error detection

1. Physical Transmits raw bits as electrical, optical or radio signals

2. Compare the OSI model with the TCP/IP model.

Basis OSI model TCP/IP model

Layers Seven layers Four conceptual layers

Purpose Reference model for standardization Practical Internet protocol suite

Upper layers Application, Presentation, Session Combined as Application

Lower layers Data Link and Physical are separate Combined as Link / Network Access

Development Model defined before protocols Protocols existed before the model

Use Learning, design and troubleshooting Real-world Internet communication

3. Explain encapsulation and de-encapsulation in computer networks.

ENCAPSULATION AT THE SENDER

+ TCP header + IP header + MAC header/trailer

Application data Bits on medium
SEGMENT PACKET FRAME

Each lower layer adds control information needed for delivery.

DE-ENCAPSULATION AT THE RECEIVER

Received bits Frame checked Packet routed Segment processed Data to application

The receiver removes headers in reverse order and delivers the original data.
4. Differentiate between a hub, switch and router based on how they forward data.

Basis Hub Switch Router

OSI layer Physical Data Link Network

Forwarding basis No address lookup Destination MAC Destination IP

Forwarding action Repeats to every port Sends to selected port Selects next network hop

Collision domains One shared domain One per switch port One per interface

Broadcast scope Forwards all signals Forwards LAN broadcasts Separates broadcasts

Main use Legacy shared Ethernet Connect devices in a LAN Connect different networks
5. Why does a device need both a MAC address and an IP address for communication?

An IP address identifies the logical source and END-TO-END IP, HOP-BY-HOP MAC

destination across interconnected networks.

A MAC address identifies the next network Host A

Router
Server
IP [Link] IP [Link]
interface on the current local link. MAC AA
MAC R1 / R2
MAC BB

Routers keep the end-to-end IP addresses but

replace the link-layer addresses at every hop. Frame 1: AA -> R1 Frame 2: R2 -> BB

ARP resolves the next-hop IPv4 address into IP packet remains [Link] -> [Link]

the MAC address required to build the local

frame.
6. How does a switch learn and use MAC addresses to forward frames?

The switch records the source MAC address MAC LEARNING AND FORWARDING
against the frame's incoming port.

It searches the MAC table for the destination Host A Host B

address. MAC AA SWITCH MAC BB
Port 1 Port 3

A known destination is forwarded only through the

associated port.
MAC TABLE
An unknown destination is flooded through every
port except the incoming port. AA -> Port 1
BB -> Port 3
Dynamic entries are removed after an ageing
period if no frames are seen.
7. How does ARP resolve an IP address into a MAC address?

The sender first checks its ARP cache for an ARP REQUEST AND REPLY

existing mapping. Broadcast request: Who has

[Link]?

If absent, it broadcasts: Who has the required Sender Target

IPv4 address? [Link]
Unicast reply: [Link] is
[Link]
MAC AA MAC BB
at BB

The matching device replies with its MAC

address using a unicast ARP reply.

The sender caches the mapping and uses it

to build the Ethernet frame. ARP cache updated
[Link] -> BB

For a remote destination, the sender resolves

the default gateway's MAC address.
8. What is a Single Point of Failure (SPOF) in a network?

A Single Point of Failure is one device, link, or service whose failure can stop the entire network
or an important network service.

Examples include one router, one switch, one Internet link, one firewall, or one DNS server.

If that single component fails, users may lose Internet access, application access, or
communication with other systems.

It is avoided by adding redundancy, such as backup links, duplicate devices, failover systems,
and multiple DNS servers.

Why is it dangerous?
It can cause complete service downtime without any backup path.
It increases business loss, user disruption, and recovery time.
A failure during high-traffic or critical operations can affect many users at once.
9. Compare IPv4 and IPv6.

Basis IPv4 IPv6

Address size 32 bits 128 bits

Notation Dotted decimal Hexadecimal with colons

Header Variable 20-60 bytes Fixed 40-byte base header

Broadcast Supported Replaced by multicast / anycast

Configuration Manual or DHCP SLAAC, DHCPv6 or manual

Fragmentation Hosts and routers may fragment Only the source fragments

Address resolution ARP Neighbor Discovery using ICMPv6

10. How does NAT allow multiple private devices to access the Internet through one public IP address?

PAT TRANSLATION
The router replaces each private source
IP with its public IP before forwarding
[Link]:51514
traffic.
NAT ROUTER
Internet
PAT also assigns a unique public-side Public IP
Server
[Link]
port to identify every active connection. [Link]:51515

The translation table maps each public

port back to the correct private IP and
port.
TRANSLATION TABLE
Reply packets are translated in reverse
[Link]:51514 -> [Link]:62001
and delivered to the original device. [Link]:51515 -> [Link]:62002
11. For the classless IP address [Link]/26,
Calculate: Network address, Broadcast address, Number of usable host addresses

/26 means 26 network bits and 6 Network address Broadcast address

host bits.
[Link] [Link]
Subnet mask: [Link]

Block size: 256 − 192 = 64 addresses Usable host range

per subnet. [Link] – [Link]

70 falls in the 64–127 block, so the

network starts at 64. Number of usable hosts
62
Usable hosts: 2⁶ − 2 = 62 hosts.

Subnet range visual

64 65 – 126 usable hosts 127

12. Explain the DHCP DORA process.

DHCP CLIENT DHCP SERVER

1 DISCOVER - client broadcasts for a server

2 OFFER - server proposes an IP and lease

3 REQUEST - client requests the selected offer

4 ACKNOWLEDGE - server confirms the lease

The acknowledgement includes the IP address, subnet mask, gateway, DNS servers and lease time.
13. How does a host decide whether to send a packet directly or through the default gateway?

Destination IP

Apply the subnet mask to source and destination IPs

Do both produce the same network ID?

YES NO

ARP for destination MAC ARP for gateway MAC

and send directly and send frame to router
14. How does traceroute discover the path followed by a packet?

Traceroute sends probes with TTL values of

1, 2, 3 and so on. TTL REVEALS ONE HOP AT A TIME

Every router decreases TTL by one before

forwarding a packet.
Source Router 1 Router 2 Router 3 Destination

When TTL reaches zero, that router returns

TTL 1 TTL 2 TTL 3 TTL 4
an ICMP Time Exceeded message.

The sender records the router address and

round-trip time for each TTL. Each expired probe produces an ICMP reply
identifying that hop.

The process ends when the destination

responds or the hop limit is reached.
15. What happens when an IP packet is larger than the network MTU?

The MTU is the largest network-layer packet a link PACKET LARGER THAN MTU
can carry without fragmentation.
Original IP packet
In IPv4, a router may fragment the packet when 3000 bytes
the Don't Fragment flag is clear.

With Don't Fragment set, the router drops it and IPv4 example: 20-byte header, MTU 1500

returns ICMP Fragmentation Needed.

Fragment 1 Fragment 2 Fragment 3
IPv6 routers never fragment; the source adjusts 1500 B 1500 B 40 B total
packet size using Path MTU Discovery.

Fragments are reassembled only at the final destination.

Fragmentation adds headers and makes the
entire packet vulnerable if one fragment is lost.
16. Compare TCP and UDP.

Basis TCP UDP

Connection Connection-oriented Connectionless

Reliability ACKs and retransmissions No delivery guarantee

Ordering Delivers bytes in order Datagrams may arrive out of order

Control Flow and congestion control No built-in control

Header Minimum 20 bytes 8 bytes

Best for Web, email, files, remote login DNS, voice, gaming, streaming
17. Why does TCP use a three-way handshake to establish a connection?

CLIENT SERVER

1 SYN, sequence = x

2 SYN-ACK, sequence = y, acknowledgement = x + 1

3 ACK, acknowledgement = y + 1

Three messages confirm two-way reachability and synchronize both initial sequence numbers.
18. How does TCP provide reliable and ordered data delivery?

Sequence numbers identify byte positions LOSS, ACKNOWLEDGEMENT AND RETRANSMISSION

and let the receiver reorder data.

SEQ 1 - 1000 bytes
Sender Receiver
Acknowledgements confirm the next byte the
receiver expects.
ACK 1001

A checksum detects corruption in the TCP

segment.
SEQ 1001 - lost
X
Timeouts and duplicate acknowledgements
trigger retransmission of missing data. Retransmit SEQ 1001

The receive window prevents the sender

from overwhelming the receiver.
Only acknowledged bytes move the
reliable stream forward.
19. How do ports and sockets allow multiple applications to use the same IP
address?

A port number identifies an application or OPERATING SYSTEM DEMULTIPLEXING

network service on a host.
Incoming packets
[Link]
A socket endpoint combines an IP address,
transport protocol and port number.

The operating system uses the packet's

TCP / UDP ports
protocol and port to deliver it to the correct
process.

A TCP connection is uniquely identified by

source IP, source port, destination IP and
Browser Video call Web server
destination port. TCP 51024 UDP 53000 TCP 443
Therefore, many connections can share one
local IP address without mixing their data.
20. How does DNS resolve a domain name into an IP address?

The browser, operating system and DNS LOOKUP PATH

resolver caches are checked first.

A recursive resolver queries the DNS

hierarchy when no cached answer Browser
Recursive
Root .com TLD
Authoritative
resolver DNS
exists.
The root server directs it to the correct
top-level-domain server.

The TLD server directs it to the

Answer: [Link] -> [Link]
domain's authoritative name server.

The authoritative server returns the The resolver returns and caches the
answer.
record, which is cached for its TTL.
21. How does HTTPS secure communication between a browser and a server?

The browser starts a TLS handshake after TLS CREATES A SECURE CHANNEL
connecting to the server.

Certificate + key exchange

The server presents a digital certificate Browser Web server
containing its identity and public key.

Encrypted HTTP request

The browser validates the certificate chain,
hostname and validity period.

Both sides establish shared session keys Encrypted HTTP response

using authenticated key exchange.

HTTP data is then encrypted and integrity-

protected inside the TLS connection. Confidentiality + Integrity + Server authentication
22. What happens in the network after a user enters a URL in a browser?

FROM URL TO RENDERED PAGE

1. Parse URL 2 . Resolve domain 3. Reach gateway 4. Establish 5. Complete TLS

and check cache with DNS and route packets TCP or QUIC for HTTPS

6. Send HTTP 7. Server processes 8. Receive HTTP 9. Fetch page 10. Render
request request response resources the page

Caching can skip some steps, while HTTP/3 uses QUIC instead of TCP.
23. A computer is connected to Wi-Fi but cannot open any website. How would you troubleshoot the problem
step by step?

WHAT EACH TEST REVEALS

1 Check Wi-Fi signal and IP configuration
Result Likely issue

2 Ping the default gateway No valid IP / 169.254.x.x DHCP or router configuration

Gateway unreachable Local Wi-Fi, adapter or router

3 Ping a public IP such as [Link]
Public IP unreachable Routing or ISP connectivity

4 Test DNS with nslookup IP works, domain fails DNS configuration or resolver

Only one browser fails Browser, proxy, VPN or firewall

5 Check proxy, VPN, firewall and browser
24. How would you respond to a suspected network security breach?

A fast, structured response limits damage and Incident response flow

preserves evidence.
Detect

1. Verify the alert using logs, IDS alerts and ↓

affected-system checks. Contain
2. Contain the incident: isolate compromised ↓
devices or accounts. Investigate & preserve evidence
3. Preserve evidence before changes—logs, ↓
packet captures and timestamps.
Eradicate
4. Remove the cause, patch weaknesses and
↓
reset exposed credentials.
Recover & monitor
5. Recover safely, monitor closely and
document the incident.
Contain first, then investigate, eradicate and
recover.
 25. Explain how you would protect an organization against DDoS attacks.

Defense in depth
DDoS protection uses multiple layers to absorb, filter
and monitor malicious traffic.

1. Use a DDoS protection service or CDN to Attack traffic CDN / DDoS WAF
absorb large traffic floods. → → Filters & rate
Botnet flood Absorbs flood
limits
2. Configure firewalls, WAF rules and rate
limits for suspicious requests. ↓
3. Use load balancers and redundant servers
to spread genuine traffic. App
Valid users
4. Monitor traffic baselines and alert teams served
when unusual spikes appear.
5. Keep an incident plan with ISP / cloud-
provider escalation contacts. Traffic is filtered at every stage before reaching the
application.