Domain 4 (Isc)^2

Which OSI Layer is responsible for user-facing services; where apps communicate with the network

Application (Layer 7)

OSI Application Layer (PDU)

Data

HTTP operates in which OSI Layer

Application (Layer 7)

HTTPS operates in which OSI Layer

Application (Layer 7)

FTP operates in which OSI Layer

Application (Layer 7)

DNS operates in which OSI Layer

Application (Layer 7)

SMTP operates in which OSI Layer

Application (Layer 7)

SSH operates in which OSI Layer

Application (Layer 7)

NTP operates in which OSI Layer

Application (Layer 7)

IMAP operates in which OSI Layer

Application (Layer 7)

POP3 operates in which OSI Layer

Application (Layer 7)

WAF device operates in which OSI Layer

Application (Layer 7)

Which OSI Layer is responsible for data formatting, encryption/decryption, compression

Presentation (Layer 6)

OSI Presentation Layer (PDU)

Data

SSL/TLS operates in which OSI Layer

Presentation (Layer 6)

Which OSI Layer is responsible for opening, managing, and closing sessions between applications

Session (Layer 5)

OSI Session Layer (PDU)

Data

Sockets are found in which OSI Layer

Session (Layer 5)

NetBIOS operates in which OSI Layer

Session (Layer 5)

Which OSI Layer is responsible for end-to-end delivery, error checking, flow control

Transport (Layer 4)

OSI Transport Layer (PDU)

Segments

TCP operates in which OSI Layer

Transport (Layer 4)

UDP operates in which OSI Layer

Transport (Layer 4)

Stateful firewalls operate in which OSI Layer

Transport (Layer 4)

IDS/IPS operates in which OSI Layer

Transport (Layer 4)

Which OSI Layer is responsible for logical addressing (IP) and routing between networks

Network (Layer 3)

OSI Network Layer (PDU)

Packets

IP operates in which OSI Layer

Network (Layer 3)

ICMP operates in which OSI Layer

Network (Layer 3)

ARP operates in which OSI Layer

Network (Layer 3)

IPsec operates in which OSI Layer

Network (Layer 3)

VPN operates in which OSI Layer

Network (Layer 3)

Routers operate in which OSI Layer

Network (Layer 3)

Packet Filter (Gen 1) firewall operates in which OSI Layer

Network (Layer 3)

Which OSI Layer is responsible for physical addressing (MAC addresses), framing, error detection

Data Link (Layer 2)

OSI Data Link Layer (PDU)

Frames

Ethernet operates in which OSI Layer

Data Link (Layer 2)

MAC Addresses operate in which OSI Layer

Data Link (Layer 2)

Switches operate in which OSI Layer

Data Link (Layer 2)

Which OSI Layer is responsible for raw binary signals over physical media

Physical (Layer 1)

OSI Physical Layer (PDU)

Bits

Wi-Fi operates in which OSI Layer

Physical (Layer 1)

Fiber optic operates in which OSI Layer

Physical (Layer 1)

RJ-45 connectors are found in which OSI Layer

Physical (Layer 1)

Hubs operate in which OSI Layer

Physical (Layer 1)

OSI Layer 7

Application

OSI Layer 6

Presentation

OSI Layer 5

Session

OSI Layer 4

Transport

OSI Layer 3

Network

OSI Layer 2

Data Link

OSI Layer 1

Physical

OSI mnemonic top to bottom

All People Seem To Need Data Processing (Application, Presentation, Session, Transport, Network, Data Link, Physical)

OSI mnemonic bottom to top

Please Do Not Throw Sausage Pizza Away (Physical, Data Link, Network, Transport, Session, Presentation, Application)

What are the 4 layers of the TCP/IP Protocol Stack

Application, Transport, Internet, Network Access

TCP/IP Application Layer maps to which OSI layers

OSI Layers 5, 6, and 7 (Session, Presentation, Application)

TCP/IP Layer maps to which OSI layer

OSI Layer 4 (Transport)

TCP/IP Internet Layer maps to which OSI layer

OSI Layer 3 (Network)

TCP/IP Network Access Layer maps to which OSI layers

OSI Layers 1 and 2 (Physical and Data Link)

What does TCP stand for

Transmission Control Protocol

TCP is connection-oriented or connectionless?

Connection-oriented (uses 3-way handshake)

What does UDP stand for

User Datagram Protocol

UDP is connection-oriented or connectionless?

Connectionless (no handshake)

Which is faster, TCP or UDP?

UDP (less overhead, no handshake)

Which is more reliable, TCP or UDP?

TCP (guaranteed delivery, tracks every packet)

What is the TCP 3-way handshake sequence?

SYN → SYN-ACK → ACK

What does SYN stand for in TCP handshake

Synchronize

What does ACK stand for in TCP handshake

Acknowledge

Does UDP use a 3-way handshake?

No — UDP is connectionless, no handshake

File Transfer Protocol (Port)

20/21

File Transfer Protocol — Secure or Insecure?

Insecure — use SFTP (port 22) instead

Secure Shell (Port)

22

SFTP (Secure File Transfer Protocol) uses which port

22 (runs over SSH)

SCP (Secure Copy Protocol) uses which port

22 (runs over SSH)

Telnet (Port)

23

Telnet — Secure or Insecure?

Insecure — plaintext. Replaced by SSH (22)

Simple Mail Transfer Protocol (Port)

25

SMTP — what does it do

Sends email between servers

Domain Name Service (Port)

53 (think AWS route 53!)

DNS — what does it do

Translates domain names (google.com) to IP addresses

HTTP — HyperText Transfer Protocol (Port)

80

HTTP — Secure or Insecure?

Insecure — use HTTPS (443) instead

Post Office Protocol v3 (Port)

110

POP3 — what does it do

Downloads email from server to client; deletes from server

Network Time Protocol (Port)

123

NTP — what does it do

Network Time Protocol - Synchronizes clocks for systems/devices on network

NTP — why is time synchronization important for security

Critical for log correlation — if clocks are different, you can't trace when events occurred

NetBIOS (Ports)

137, 138, 139

NetBIOS — what does it do

Windows file and printer sharing on local networks

Internet Message Access Protocol (Port)

143

IMAP — what does it do

Reads email from server without deleting it; syncs across multiple devices

HTTPS — HyperText Transfer Protocol Secure (Port)

443

HTTPS — Secure or Insecure?

Secure — uses TLS encryption

Remote Desktop Protocol (Port)

3389

RDP — what does it do

Provides remote graphical access to Windows machines

Port range for Well-Known ports

0–1023

Port range for Registered ports

1024–49151

Port range for Dynamic/Ephemeral ports

49152–65535

Total number of possible logical ports

65,536 (range 0 to 65,535)

Which protocol synchronizes time across systems and devices?

NTP (Network Time Protocol) — Port 123