Capstone — the whole chain

What this checks. That you can follow one request across every protocol it touches, say which layer failed from the evidence, and explain why the plausible answer is wrong. You need 6 of 8 to pass, and every option is explained afterwards — including the ones you did not pick.

1. 1/8A laptop has just been plugged in. It has a MAC address and nothing else. What is the first thing it puts on the wire?

   Predict what happens next

   A DHCP DISCOVER, broadcast, from source address 0.0.0.0

   An ARP request for the gateway

   A DNS query for the site
2. 2/8In the frame carrying a request to a server two networks away, the Ethernet destination and the IP destination name different machines. Which is which?

   Identify the responsible endpoint

   Ethernet names the next router; IP names the final server

   Ethernet names the server; IP names the router

   They always name the same machine and this indicates a fault
3. 3/8What distinguishes the control plane from the data plane?

   Tell two ideas apart

   The control plane builds the information about where things are; the data plane uses it to move somebody's traffic

   The control plane runs first and then stops

   The control plane is management traffic like SSH to a router
4. 4/8Every device is up, the BGP session is established and exchanging keepalives, and a ping to an external service returns ICMP Destination Unreachable from the local router within milliseconds. What failed?

   Diagnose a failure

   Nothing failed — the route was never announced, so the router has no entry for that destination

   The BGP session is down

   The destination host is switched off
5. 5/8You must prove that a slow page load is not the network's fault. Which set of observations does it?

   Choose the evidence

   No retransmissions, no resets, no zero windows, the request acknowledged immediately, and a long gap before the response's first byte

   A high round-trip time on the handshake

   A large response body
6. 6/8A capture shows a DNS answer, a completed handshake, and then a fatal TLS alert from the client. Someone blames DNS hijacking. What is the stronger reading?

   Say why an answer is wrong

   The certificate's name and the requested name disagree, which is visible directly and is the proximate cause of the abort

   The handshake completing rules out any certificate problem

   A fatal alert always means a cipher mismatch
7. 7/8A client sends a SYN with sequence 5000 and no data. The server replies SYN-ACK with sequence 9000. What sequence and acknowledgement numbers does the client's final ACK carry?

   Work out a value

   Sequence 5001, acknowledgement 9001

   Sequence 5000, acknowledgement 9000

   Sequence 5001, acknowledgement 5001
8. 8/8A new office is built with correct addressing, a working DHCP server and a resolver, and an internet circuit that is up. Nothing outside the office is reachable. Which two checks come first, and in what order?

   Apply it somewhere new

   Whether the local router has a route to the destination, and only then whether the protocol supplying that route has a healthy session

   Whether DNS resolves, and then whether the web server responds

   Whether the circuit's interface counters are incrementing, and then whether the cable is seated