503.1.

1 - INTRO TEST QUESTIONS

1. What protocol is connection-orientated and reliable:

a) ICMP
b) IP
c) TCP
d) UDP

2. What protocol is responsible for routing the packet from source to destination:

a) ICMP
b) IP
c) TCP
d) UDP

3. What protocol is responsible for communicating non-transient error messages:

a) ICMP
b) IP
c) TCP
d) UDP

4. What protocol is a lightweight transport protocol:

a) ICMP
b) IP
c) TCP
d) UDP

5. What is the purpose of Address Resolution Protocol (ARP):

a) To translate hostnames to IP numbers

b) To translate IP numbers to hostnames
c) To associate port numbers to services
d) To associate IP addresses and MAC addresses

6. What is the most accurate description of tcpdump:

a) It is a packet capturing tool

b) It is a sophisticated intrusion detection tool
c) It is a lightweight firewall
d) It is a sophisticated packet-generating tool

7. Assuming you’ve checked all of a normal datagram, what part will you always see:

a) An ICMP header
b) An IP header
c) A TCP header
d) A UDP header

8. What field is found in the 9th byte offset of the IP header:

a) The embedded protocol found in the IP header

b) The embedded destination port found in the IP header
c) The embedded ICMP error type and code found in the IP header
d) The destination IP
9. What are the two mechanisms TCP uses to recognise packet loss:

a) Duplicate sequence numbers and keep alive timer

b) Duplicate acknowledgement numbers and retransmission timers
c) Undersized packets and TCP checksum validation
d) Corrupted TCP data and out of order sequence numbers

10. How does a receiver inform a sender it has received TCP data:

a) It sets the acknowledgement flag and an acknowledgement value of 1 less than the last
TCP sequence number received
b) It sets the acknowledgement flag and a null acknowledgement number
c) It sends a duplicate acknowledgement number
d) It sets the acknowledgement flag and an acknowledgement value of 1 more than the last
TCP sequence number received

11. Historically, for what purpose were ports with numbers less than 1024 used:

a) UDP connections
b) TCP connections
c) Server connections
d) Ephemeral connections

12. Historically, for what purpose were ports with numbers more than 1024 used:

a) UDP connections
b) TCP connections
c) Server connections
d) Ephemeral connections

13. The purpose of prepending new headers to upper layer data to form a packet or frame is
know as what:

a) De-multiplexing
b) Encapsulation
c) Bloating
d) Gluttony

14. The TCP SYN flag signals the intent to do what:

a) Establish a new connection

b) Full-duplex communication between two hosts on selected ports
c) A one-way communication between two hosts on selected ports
d) Send some data to an existing connection

15. The TCP three-way handshake accomplishes:

a) A broadcast communication between multiple hosts on selected ports

b) Full-duplex communication between two hosts on selected ports
c) A one-way communication between two hosts on selected ports
d) A client-server communication between two or more hosts on ephemeral ports

16. (T/F) The IP protocol field will have a value of 6 if a TCP segment follows the IP header.

17. (T/F) ICMP ports will always be server ports

18. (T/F) TCP sequence numbers are used to order the stream of segments sent.

19. (T/F) By default, tcpdump will attempt to resolve IP numbers to hostnames.

20. (T/F) When looking at a tcpdump output, a byte of data is represented by a lone hex
character.

21. (T/F) When counting tcpdump offsets, always begin with an offset of 1.

22. (T/F) ARP works by first sending a broadcast ARP request asking all hosts on the local
segment to respond with a MAC address for the specific IP.

23. (T/F) ICMP errors are used for temporary errors like invalid checksums.

24. (T/F) If an ICMP error message is in error, an ICMP error message should be transmitted to
the original sender.

25. (T/F) The majority of internet traffic is transported using TCP.

26. (T/F) If enough of an ICMP error message is collected, there should be some embedded
data in the ICMP payload that reflects the IP datagram that caused the error.

27. (T/F) The TCP handshake requires 2 packet exchanges to complete.

28. (T/F) The TCP retransmission timer is used when no response/ acknowledgement is
received to a sent TCP segment.

29. (T/F) The TCP PUSH flag is set to signal a session termination.

30. (T/F) UDP has built in flow control and ordering of UDP datagrams.
 503.1 - INTRO TEST ANSWERS

1. C
2. B
3. A
4. D
5. D
6. A
7. B
8. A
9. B
10. D
11. C
12. D
13. B
14. A
15. B
16. T
17. F
18. T
19. T
20. F
21. F
22. T
23. F
24. F
25. T
26. T
27. F
28. T
29. F
30. F