CH. 6 Protocols/secure communications

[6.1] What is TCP?

A connection-oriented transport protocol supporting reliable / ordered delivery through acknowledgments and retransmission.

[6.1] What is UDP?

A connectionless transport protocol that does not itself guarantee delivery / ordering / or retransmission.

[6.1] What is the TCP three-way handshake?

SYN / SYN-ACK / ACK.

[6.1] What is TCP flow control?

Adjusting transmission to the receiver's advertised capacity so the sender does not overwhelm it.

[6.1] Does choosing UDP mean an application can never be reliable?

No. An application can implement reliability itself above UDP.

[6.1] What is segmentation and reassembly?

Dividing data into smaller transport units and reconstructing it at the destination.

[6.1] IP protocol number versus TCP/UDP port number?

An IP protocol number identifies the next protocol / such as TCP. a port identifies an application endpoint within TCP or UDP.

[6.1] What are the IP protocol numbers for TCP and UDP?

TCP: 6. UDP: 17.

[6.1] Does IPv6 automatically encrypt network traffic?

No. Encryption requires a configured security protocol. IPv6 alone does not make traffic encrypted.

[6.2] What is a static route?

A route explicitly configured by an administrator.

[6.2] What is dynamic routing?

Routers use a routing protocol to exchange information and update routes as conditions change.

[6.2] What is an IGP?

An interior gateway protocol used within an autonomous system.

[6.2] What is routing convergence?

The process of routers reaching a consistent updated view after a network change.

[6.2] What metric does RIP use?

Hop count. 15 is the maximum reachable hop count and 16 means unreachable.

[6.2] How much exam study time should go to IGRP details?

Lower priority than the explicitly listed N10-009 routing protocols OSPF / EIGRP / and BGP. IGRP is obsolete.

[6.3] What is OSPF?

A link-state IGP that calculates routes using a topology database and cost metrics.

[6.3] What is EIGRP?

An advanced distance-vector IGP using a composite metric / normally based on bandwidth and delay by default.

[6.3] What is BGP?

A path-vector routing protocol used for exchanging reachability information / especially between autonomous systems.

[6.3] What is longest-prefix matching?

Choosing the most specific matching route for a packet's destination.

[6.3] A destination matches both /16 and /24 routes. Which is more specific?

The /24 route / because more destination bits must match.

[Extra: N10-009] What is administrative distance?

A measure of route-source preference used when comparing routes to the same prefix from different sources. lower is generally preferred.

[Extra: N10-009] What is a routing metric?

A protocol's path comparison value / such as cost or hop count. metrics from different protocols are not directly interchangeable.

[6.3] What is a default route?

A route used when no more specific destination route matches. IPv4 commonly uses 0.0.0.0/0.

[6.3-6.4] LLDP versus CDP?

LLDP is standards-based neighbor discovery. CDP is Cisco's discovery protocol.

[6.4] What does ARP do?

Resolves a local IPv4 address to a MAC address.

[6.4] When sending to a remote IPv4 subnet / whose MAC does a host normally resolve?

The local next-hop router's MAC / not the remote destination's MAC.

[6.4] What does IPv6 use instead of ARP?

Neighbor Discovery Protocol (NDP) / using ICMPv6 messages.

[6.4] What is ICMP used for?

IP control and error reporting / including echo requests/replies used by ping.

[6.4] Does ICMP use a TCP or UDP port?

No. It is carried directly within IP.

[6.4] What is SNMP used for?

Monitoring and managing network devices.

[6.4] SNMP polling versus traps?

Polling requests information from an agent. traps are notifications sent by an agent without a polling request.

[Extra: N10-009] Why prefer properly configured SNMPv3 over SNMPv2c?

SNMPv3 can provide authentication and encryption. v2c relies on community strings without equivalent protection.

[6.4] What is SMB used for?

Sharing files / printers / and related resources / commonly in Windows networks.

[6.4] What is ARP poisoning?

Sending misleading ARP information to alter IP-to-MAC mappings and potentially redirect traffic.

[6.5] What is TLS used for?

Protecting communications with encryption / integrity checks / and peer authentication as configured.

[6.5] Should SSL be used for modern secure communication?

No. SSL is obsolete. use supported TLS versions and secure configurations.

[6.5] What is symmetric encryption?

Encryption using a shared secret key for encryption and decryption.

[6.5] What is asymmetric cryptography?

Cryptography using a mathematically related public/private key pair.

[6.5] Which key must remain secret in a public/private key pair?

The private key.

[6.5] In a public-key encryption example / which key does a sender use for confidentiality?

The receiver's public key. the receiver uses the corresponding private key to decrypt.

[6.5] What does a digital signature help establish?

Integrity and authenticity. the private key signs and the corresponding public key verifies.

[6.5] What is a certificate authority (CA)?

An entity that issues digitally signed certificates binding identities to public keys.

[6.5] What is PKI?

Public key infrastructure: systems and processes for managing certificates / trust / and public/private keys.

[6.5] What is SSH used for?

Encrypted remote command-line access and related secure functions.

[6.5] SSH versus Telnet?

SSH encrypts the session. Telnet normally sends information without encryption.

[6.5] What are SFTP and SCP used for?

Secure file transfer using SSH.

[6.5] Is SFTP the same protocol as FTP over TLS (FTPS)?

No. SFTP uses SSH. FTPS secures FTP with TLS.

[6.5] What is IPsec?

A suite of protocols protecting IP communication / often used for VPNs.

[6.5] AH versus ESP in IPsec?

AH provides authentication/integrity without payload encryption. ESP can provide payload encryption plus integrity/authentication.

[6.5] What does IKE do for IPsec?

Negotiates security associations and keying material.

[6.6] What are FTP's traditional TCP ports?

21 for control. 20 for server data connections in active FTP. Passive FTP uses a negotiated data port.

[6.5-6.6] What port do SSH / SFTP / and typical SCP connections use?

TCP 22.

[6.6] What port does Telnet use?

TCP 23.

[6.6] What port is used for SMTP relay?

TCP 25.

[Extra: N10-009] What port is associated with secure SMTP submission?

TCP 587 / commonly using STARTTLS. CompTIA lists this as SMTPS.

[4.1/6.6] What port does DNS use?

53 over UDP or TCP.

[4.1] What ports does DHCPv4 use?

UDP 67 for the server and UDP 68 for the client.

[6.6] What port does TFTP use for the initial request?

UDP 69. the transfer then uses negotiated UDP endpoints.

[6.6] What port does HTTP commonly use?

TCP 80.

[4.1] What port does NTP use?

UDP 123.

[6.4] What ports are commonly used by SNMP?

UDP 161 for requests and UDP 162 for traps/notifications.

[6.1] What ports are commonly used by LDAP and LDAPS?

LDAP: 389. LDAPS: TCP 636.

[6.6] What port does HTTPS commonly use?

443. TCP for HTTP/1.1 and HTTP/2 / and UDP with QUIC for HTTP/3.

[6.4] What port does direct-hosted SMB commonly use?

TCP 445.

[4.1] What port is commonly associated with traditional syslog?

UDP 514. other transports and secure configurations exist.

[4.1] What port does Microsoft SQL Server commonly use?

TCP 1433.

[6.6] What port does RDP commonly use?

3389. modern implementations can use TCP and UDP.

[4.1] What ports are commonly associated with SIP signaling?

5060 for unencrypted SIP and 5061 for SIP over TLS.

[6.6] POP3 versus IMAP?

POP3 is commonly used to download messages. IMAP supports server-side folders and synchronization across devices.

[6.6] What are the POP3 and secure POP3 ports?

TCP 110 and TCP 995.

[6.6] What are the IMAP and secure IMAP ports?

TCP 143 and TCP 993.

[6.7] What is the practical lesson of the asymmetric cryptography lab?

Share public keys as appropriate / protect private keys / and understand which key performs encryption or verification.

[6.8] What is the basic scp syntax for copying a local file to a remote host?

scp localfile user@host:destination-path. quote paths when the environment requires it.

[6.8] Why might SSH fail even if ping works?

The SSH service may be stopped / TCP 22 blocked / credentials incorrect / or the host key/configuration unsuitable.

[6.4] Does a failed ping always prove a host is offline?

No. ICMP may be filtered even when application services are reachable