Cyber & Networking Study Guide (E01–E04)

Comprehensive flashcards covering Modules E01 through E04: DODIN Cyberspace Operations, OSI Model, MAC Addresses, and Fundamentals of Networking.

What minimum score is required on the end-of-module exam for each module in the Cyber & Networking course?

A score of $70\%$ is required on each end-of-module exam.

What is the Department of Defense Information Network (DODIN)?

The DODIN is the collection of networks owned and managed by the DoD. It is a globally interconnected, end-to-end set of information capabilities for collecting, processing, storing, disseminating, and managing information for warfighters, policy makers, and support personnel, including all systems, communications media, data, security, and peripherals.

What are the three networks that make up the DODIN, and what are their classification levels?

NIPRNet (Sensitive but unclassified), SIPRNet (Up to SECRET), and JWICS (Top Secret / SCI).

How does SIPRNet transmit data without connecting directly to the public internet?

SIPRNet is the DoD's secret version of the internet that travels through NIPRNet via tunneling, but it does not connect to the public internet.

Which DODIN network is air-gapped, and how is it accessed?

JWICS (Top Secret / SCI); it is accessed in SCIFs and is air-gapped (fully separate from the internet, physical access only).

What is the definition of Cyberspace Operations (CO)?

The employment of cyberspace capabilities where the primary purpose is to achieve objectives in or through cyberspace.

What are the three lines of operation for USCYBERCOM?

1. Secure, operate, and defend the DODIN; 2. Defend the nation from attack in cyberspace; 3. Provide cyberspace support to combatant commanders (CCDRs).

How does Cyberspace Operations relate to the joint function of Fires?

Cyberspace attack creates effects, often with little or no physical destruction; can be offensive or defensive, supporting or supported; and must comply with the law of war and ROE.

What are the three cyberspace missions and their respective focuses?

1. DODIN Operations (network-focused, threat-agnostic standing mission); 2. DCO / Defensive Cyberspace Operations (threat-specific); 3. OCO / Offensive Cyberspace Operations (requires a properly coordinated military order).

What is the key distinction between DODIN Operations and DCO (Defensive Cyberspace Operations)?

DODIN operations try to secure DoD cyberspace from all threats before any specific threat shows up, whereas DCO defeats a specific threat that is already breaching or about to breach security.

What are the four main threats to the DODIN?

1. Nation-state threats; 2. Non-state threats; 3. Individuals or small groups; 4. Accidents and natural hazards.

What are the three operational elements of the Cyber Mission Force (CMF)?

1. Cyber Protection Force (CPF), made up of Cyberspace Protection Teams (CPTs); 2. Cyber National Mission Force (CNMF), made up of National Mission Teams (NMTs), National Support Teams (NSTs), and national-level CPTs; 3. Cyber Combat Mission Force (CCMF), made up of Combat Mission Teams (CMTs) and Combat Support Teams (CSTs).

What are the three layers of cyberspace?

1. Physical network (IT devices and infrastructure that store, transport, and process information); 2. Logical network (elements related to each other through code, abstracted from the physical network); 3. Cyber-persona (digital representation of an actor or entity identity, abstracted from the logical layer).

What distinguishes DCO-IDM from DCO-RA?

DCO-IDM (Internal Defensive Measures) consists of actions inside the defended network authorized by standing order (NSPM-13). DCO-RA (Response Actions) consists of actions external to the defended network, without the permission of the system owner, normally in foreign cyberspace, requiring a coordinated military order.

What are the four primary cyberspace actions and their associated missions?

1. Cyberspace security (DODIN Ops); 2. Cyberspace defense (DCO-IDM); 3. Cyberspace exploitation (OCO / DCO-RA); 4. Cyberspace attack (OCO / DCO-RA).

What are the five actions included in Cyberspace Defense?

Detect, characterize, counter, mitigate, and restore to a secure configuration.

What does the acronym D4M stand for in cyberspace attack?

Deny, Degrade, Disrupt, Destroy, and Manipulate.

In the D4M framework, how do Degrade, Disrupt, and Destroy achieve target denial?

Degrade denies to a specified percentage of capacity; Disrupt completely but temporarily denies; Destroy completely and irreparably denies.

What do the colors Blue, Gray, and Red represent in cyberspace operations?

Blue represents friendly cyberspace (DODIN and other protected cyberspace); Gray represents neutral or unknown cyberspace; Red represents adversary cyberspace.

What is the purpose of the OSI Reference Model?

The OSI Reference Model standardizes network communication from the GUI down to the bits on a wire or antenna, ensures hardware from different vendors works together, and serves as a common troubleshooting tool.

What are the seven layers of the OSI model from Layer $1$ to Layer $7$?

Layer $1$: Physical; Layer $2$: Data Link; Layer $3$: Network; Layer $4$: Transport; Layer $5$: Session; Layer $6$: Presentation; Layer $7$: Application.

What are the two OSI layer mnemonics provided in the lecture?

From $1\rightarrow 7$: 'Please Do Not Throw Sausage Pizza Away'; from $7\rightarrow 1$: 'All People Seem To Need Data Processing'.

What are the Protocol Data Units (PDUs) for each of the OSI model layers?

Layer $1$: Bit; Layer $2$: Frame; Layer $3$: Packet; Layer $4$: Segment; Layers $5\text{--}7$: Data.

Which OSI layer is called the 'heart' of the OSI model, and what functions does it perform?

The Transport Layer (Layer $4$); it is responsible for the reliability and quality of traffic, segmentation and desegmentation, flow control, and congestion avoidance.

What are the primary responsibilities and key protocols of the Network Layer (Layer $3$)?

Responsible for routing, forwarding, inter-network (IP) addressing, fragmentation, and end-to-end packet delivery. Key protocols/services include IPv4/IPv6, ICMP, IGMP, IPsec, and NAT.

What are the main functions performed by the Presentation Layer (Layer $6$)?

Reformatting data so another system's Application layer can read it (file formats), data compression, character coding (ASCII, EBCDIC, UTF-8), and encryption/decryption.

What is the difference between encapsulation and decapsulation?

Encapsulation moves down the stack ($7\rightarrow 1$) adding headers at each layer (and a trailer at Layer $2$). Decapsulation moves up the stack ($1\rightarrow 7$) removing headers at each layer.

How do Simplex, Half-duplex, and Full-duplex transmission modes differ?

Simplex is one direction only (e.g., FM radio; fiber optic); Half-duplex is both directions, one at a time (e.g., walkie-talkie); Full-duplex is both directions simultaneously (e.g., phone call).

What is the difference between single-mode and multi-mode fiber optic cabling?

Single-mode has one light path, is more expensive, faster, and operates over longer distances. Multi-mode has multiple light paths, is cheaper, slower, and operates over shorter distances.

What are the four layers of the TCP/IP model and how do they map to the OSI model?

Application (maps to OSI $5$, $6$, $7$); Transport (maps to OSI $4$); Internet (maps to OSI $3$); Network Access (maps to OSI $1$, $2$).

What three Layer $1$ problems does Ethernet (802.3) at Layer $2$ solve?

1. Framing (fixes inability to tell where messages start/end or how structured); 2. Addressing via MAC addresses (fixes inability to tell sender or receiver); 3. Error detection via FCS with CRC (fixes inability to tell if bits were corrupted).

What are the seven fields of an Ethernet II frame and their sizes?

Preamble ($7\,\text{bytes}$), SFD ($1\,\text{byte}$), Destination Address ($6\,\text{bytes}$), Source Address ($6\,\text{bytes}$), Type ($2\,\text{bytes}$), Data/payload ($46\text{--}1500\,\text{bytes}$), and FCS ($4\,\text{bytes}$).

How does error detection work using the Frame Check Sequence (FCS) in an Ethernet frame?

The sender computes a value by binary division using a generating polynomial and appends the remainder as the FCS. The receiver performs the same calculation; if the remainder is not zero (values do not match), the whole frame is discarded.

What is the total bit length, byte size, and hex digit count of a standard MAC address?

A MAC address is $48\,\text{bits}$ ($6\,\text{bytes}$), represented as $12$ hexadecimal digits, providing about $2^{48}$ (approximately $281\,\text{trillion}$) possible addresses.

What are the two parts of a MAC address and what does each represent?

The first $3\,\text{bytes}$ ($6$ digits) are the OUI / Block ID, assigned by the IEEE to identify the manufacturer. The last $3\,\text{bytes}$ ($6$ digits) are the Device ID / Extension ID, assigned sequentially by the manufacturer.

How can you distinguish between a Unicast and a Multicast MAC address?

By looking at the least significant bit of the first octet: a value of $0$ indicates Unicast, while a value of $1$ indicates Multicast.

What is the broadcast MAC address in hexadecimal notation?

$$\text{FF:FF:FF:FF:FF:FF}$$

How does Address Resolution Protocol (ARP) operate?

ARP maps an IP address (Layer $3$) to a MAC address (Layer $2$). A host broadcasts an ARP request asking who owns an IP, and the owner sends a unicast reply containing its MAC address, which is stored in the ARP cache.

What is ARP poisoning (spoofing), and how can switches mitigate it?

ARP poisoning occurs when an attacker sends false ARP replies (or gratuitous ARPs) to alter IP-to-MAC mappings in devices' caches, creating a man-in-the-middle condition. It can be mitigated on switches by configuring them to allow only one MAC per port.

What are the five main network sizes from smallest to largest scope?

PAN / Personal Area ($0\text{--}30\,\text{ft}$), LAN / Local Area (one or $2\text{--}3$ nearby buildings), WLAN / Wireless LAN (same scope as LAN), MAN / Metropolitan Area (a city), and WAN / Wide Area (regions, countries, or the world).

What is the key difference between Client-Server and Peer-to-Peer network architectures?

In Client-Server, clients always initiate requests and servers continuously listen and provide resources. In Peer-to-Peer, there are no distinct roles; every device acts as both client and server within a workgroup.

How many bits are in a byte and a word, and what is $1\,\text{KB}$ in base-$2$?

A byte is $8\,\text{bits}$; a word is $2\,\text{bytes}$ ($16\,\text{bits}$); $1\,\text{KB}$ is $1024\,\text{bytes}$ ($2^{10}$).

Convert the binary byte $01000001_2$ to decimal, and the decimal value $255$ to binary.

$01000001_2 = 64 + 1 = 65$; and $255 = 11111111_2$.

Who invented the transistor at Bell Labs, and what is the quiz answer for the year it was invented?

John Bardeen, Walter Brattain, and William Shockley invented the transistor; the quiz answer for the year of invention is $1948$.

What are the characteristics, pros, and cons of a Star network topology?

In a Star topology, every node connects to a central device. Pros include centralized management, easy expansion, and node redundancy. Cons include higher cost and the central device acting as a single point of failure that dictates performance.

What is the difference between straight-through and crossover Ethernet cables?

Straight-through cables have the same pin order on both ends and connect different devices (e.g., PC to switch). Crossover cables swap transmit and receive pins ($1$ and $2$ swapped with $3$ and $6$) at one end to connect similar devices directly (e.g., PC to PC).