FE Electrical Computer Networks Practice Problems

Answer: C) RIP

The Handbook assigns the network layer the job of finding appropriate routes between end hosts and forwarding packets along them (p. 394); routing protocols are how routers build those routes, and they differ in the metric they minimise. The Routing Information Protocol, RIP, is the classic distance-vector protocol: each router periodically tells its neighbours its whole table, the metric is simply the number of routers a packet must cross, and 16 is defined as infinity, so a path of 16 or more hops is unreachable. The limit is what keeps the count-to-infinity problem of distance-vector routing bounded, and it is also what confines RIP to small networks, since a 15-hop diameter and a metric blind to link speed suit neither a campus backbone nor the Internet. The IP time-to-live field of p. 399, which has become a hop count decremented at every router, is a separate mechanism that discards looping packets regardless of the routing protocol.

OSPF is a link-state protocol: every router floods the state of its links, builds the full topology and runs a shortest-path computation on a cost that is normally derived from link bandwidth, with no 15-hop limit.

EIGRP uses a composite metric built from bandwidth and delay, with an optional load and reliability, and supports far larger hop counts.

BGP is the path-vector protocol between autonomous systems; it chooses routes by policy and path attributes, not by a hop count.

Answer: D) LAN

A local area network, the LAN of the Handbook's abbreviation list on p. 394 and of the address-assignment section on p. 406, is the network of one site: a building, an office floor or a campus under a single administration. Because the distances are short and the owner installs the cabling, a LAN runs the fastest and cheapest links available, switched Ethernet at 1 to 100 Gb/s over copper and fibre and Wi-Fi for wireless access, and its stations obtain addresses by DHCP, static configuration or SLAAC as p. 406 lists. The classes of network are defined by reach: a personal area network spans the few metres around one user, a metropolitan area network a city, and a wide area network joins sites across regions or countries over circuits leased from a carrier, at rates and latencies set by the carrier rather than the owner. The Internet is the WAN of WANs.

WAN spans cities or countries over carrier links, typically slower and higher in latency than a LAN.

MAN covers a metropolitan area, larger than a campus and smaller than a region.

PAN is the Bluetooth-scale network around a single person.

Answer: C) 28

Count from one node: it needs a link to each of the other \(n - 1 = 7\) nodes. Doing that for all 8 nodes gives \(8 \times 7 = 56\) link ends, but every link has been counted twice, once from each of its two nodes, so the number of links is

$$\dfrac{n(n - 1)}{2} = \dfrac{8 \times 7}{2} = 28$$

This is the number of ways to choose 2 nodes out of 8, since a link is simply a pair of nodes. The Handbook's mesh diagram on p. 407 shows the pattern, every station joined to every other, and the arithmetic shows its cost: the link count grows with the square of the node count, so doubling the nodes to 16 needs 120 links, and each node needs \(n - 1\) interfaces. In return the mesh has no single point of failure and a one-hop path between every pair, which is why it is used for small backbone cores and among a handful of WAN sites but never for end stations, which are served by the star of p. 407 with one link each.

56 is \(n(n - 1)\), every link counted twice.

7 is \(n - 1\), the links, or interfaces, at a single node.

8 is the link count of a ring of 8 nodes, one link per node.

Answer: C) TCP

The Handbook's Protocol Definitions on p. 394 describe the Transmission Control Protocol as a connection-oriented protocol that detects lost packets, duplicated packets or packets received out of order and has mechanisms to correct these problems. Those mechanisms are the fields of the TCP header on pp. 401 and 402: a connection is opened with the SYN flag and the exchange of initial sequence numbers, every byte is numbered, the acknowledgment number tells the sender what has arrived so that anything unacknowledged is retransmitted, the window size throttles the sender to what the receiver can hold, and FIN closes the connection. The transport layer of p. 393 is where reliability, in-order delivery, flow control and congestion control are optionally provided, and TCP is the protocol that provides them; the layers below deliver packets on a best-effort basis only.

UDP is the Handbook's connectionless-oriented protocol with less overhead than TCP but no guarantee of delivery, ordering or duplicate protection; its header on p. 403 has only ports, length and checksum.

IP is the network-layer protocol that provides end-to-end addressing and encapsulates TCP or UDP; it does not retransmit.

ICMP is the supporting protocol for error messages and operational information, the echo and unreachable messages of p. 404.

Answer: A) A zero-day exploit with no known signature

Signature-based detection compares traffic against a database of patterns extracted from attacks already seen and analysed: the byte sequence of a known exploit, the probe pattern of a scanning tool, the SQL fragments of an injection attempt like the one the Handbook defines on p. 416. It is precise and fast and produces few false alarms, but it can only recognise what has been written into its database. A zero-day exploit is by definition one for which no defence has yet been published, because the vulnerability was unknown to the vendor when the attack began; there is no signature to match, so the traffic passes as ordinary. Catching such attacks needs the other approach, anomaly-based detection, which learns a baseline of normal traffic and flags deviations from it, at the cost of more false positives; production systems combine the two. The same limitation applies to signature-based antivirus and to any endpoint detection that relies on known indicators.

A port scan made with a well-known scanning tool has a recognisable probe pattern, the SYN, NULL, FIN and XMAS scans of p. 416, and is among the easiest events to signature.

A known SQL injection attack pattern and a previously known buffer overflow exploit are exactly what the database contains; being known is what makes them detectable.