Group 05: Networking Essentials

What is an IP address?

A numerical address used to identify and communicate with a device on a network.

What is the difference between a private and public IP address?

Private addresses are used inside internal networks and are not directly internet-routable, while public addresses are routable across the internet.

What are the private IPv4 ranges?

10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.

What is a subnet mask?

A value that identifies which portion of an IP address represents the network and which portion represents the host.

What is CIDR notation?

A method of representing a network using an IP address and prefix length, such as 192.168.1.0/24.

What is a default gateway?

The router a device uses to communicate with destinations outside its local network.

What is TCP?

A connection-oriented protocol that provides reliable, ordered, and error-checked delivery.

What is UDP?

A connectionless protocol that prioritizes speed and low overhead without guaranteeing delivery or order.

What is the TCP three-way handshake?

SYN, SYN-ACK, and ACK.

What is DNS?

The system that translates domain names into IP addresses and provides other domain-related information.

What is DHCP?

A protocol that automatically assigns IP addresses, gateways, DNS servers, and other network settings.

What is the DHCP DORA process?

Discover, Offer, Request, and Acknowledge.

What is NAT?

Network Address Translation converts private addresses into public addresses or translates between address spaces.

What is a firewall?

A control that permits or blocks network traffic according to defined rules.

What is the difference between a stateful and stateless firewall?

A stateful firewall tracks active connections, while a stateless firewall evaluates each packet independently.

What is a proxy?

A system that receives and forwards requests on behalf of another device and may inspect, filter, or log the traffic.

What is a VPN?

An encrypted tunnel that protects communication across an untrusted network.

What is a VLAN?

A logical network segment used to separate devices and traffic on shared physical infrastructure.

What is network segmentation?

Dividing a network into controlled zones to limit access, attack paths, and incident spread.

What is inbound traffic?

Traffic entering a system, network, or security boundary.

What is outbound traffic?

Traffic leaving a system, network, or security boundary.

What is east-west traffic?

Traffic moving between systems inside an internal environment.

What is north-south traffic?

Traffic moving between an internal environment and an external network.

What uses port 22?

SSH for encrypted remote administration.

What uses port 25?

SMTP for transferring email between mail servers.

What uses port 53?

DNS.

What uses port 80?

HTTP for unencrypted web traffic.

What uses port 88?

Kerberos authentication.

What uses port 123?

NTP for time synchronization.

What uses port 389?

LDAP.

What uses port 443?

HTTPS for web traffic protected by TLS.

What uses port 445?

SMB for Windows file sharing and remote administration.

What uses port 636?

LDAPS, which protects LDAP communication using TLS.

What uses port 3389?

Remote Desktop Protocol.

Why should traffic not be considered legitimate only because it uses a common port?

Attackers can use legitimate ports, tunnel traffic, or configure services to communicate over nonstandard ports.

What happens when a user enters a website into a browser?

DNS resolves the domain, the client establishes a TCP connection, TLS is negotiated for HTTPS, an HTTP request is sent, and the server returns content for the browser to rende