CEH Study Guide - 02 Networking Foundations

Which of these devices would not be considered part of the Internet of Things?

• Smartphone

• Thermostat

• Light bulb

• Set-top cable box

Answer explanation

A thermostat is an embedded device without a traditional user interface.

A light bulb would have no user interface, even if it has network capabilities.

A set-top cable box would have a custom interface and not a general-purpose one.

The only device here that is a general-purpose computing platform with a traditional user interface—screen and keyboard—is the smartphone, so it isn’t part of the IoT.

If you wanted a lightweight protocol to send real-time data over, which of these would you use?

• TCP

• HTTP

• ICMP

• UDP

Answer explanation

TCP uses a three-way handshake, which is fairly heavyweight. HTTP uses TCP and adds more on top of it. ICMP is used for control messages. UDP has very little overhead and is commonly used for real-time data transport.

What order, from bottom to top, does the TCP/IP architecture use?

• Network Access, Network, Transport, Application

• Link, Internet, Transport, Application

• Physical, Network, Session, Application

• Data Link, Internet, Transport, Application

Answer explanation

From bottom to top, the TCP/IP architecture is Link, Internet, Transport, and Application.

Which of these services would be considered a storage as a service solution?

• Microsoft Azure

• iCloud

• Google Compute

• DropLeaf

Answer explanation

While Microsoft Azure and Google Compute have storage capabilities, they aren’t storage as a service solutions.

Drop leaf is a type of table.

Dropbox is a storage as a service solution.

The only one listed here that is storage as a solution is iCloud, which is Apple’s cloud storage platform.

The UDP headers contain which of the following fields?

• Source address, destination address, checksum, length

• Destination port, source port, checksum, length

• Flags, source port, destination port, checksum

• Length, checksum, flags, address

Answer explanation

The IP headers include addresses. UDP headers use ports. TCP headers use flags, but UDP headers do not.

The UDP headers have the source and destination port fields along with checksum and length.

What are the three steps in the TCP handshake as described by the flags set?

• SYN, SYN/URG, RST

• RST, SYN, ACK

• SYN, SYN/ACK, ACK

• SYN, SYN/ACK, ACK/URG

Answer explanation

The three-way handshake is used to establish a connection.

The first message has the SYN flag set and includes the sequence number.

The response from the server has the ACK flag set for the SYN message that was sent from the client.

The acknowledgment number is set.

Additionally, in the same message, the server sends its own SYN flag and sequence number.

The client then responds with an ACK message.

So, the sequence is SYN, SYN/ACK, and ACK.

Which of these protocols would be used to communicate with an IoT device?

• ICMP

• SMTP

• Telnet

• HTTP

Answer explanation

While ICMP may be used as part of passing control messages in case of errors in the network, it wouldn’t be used between the IoT device and a server.

SMTP is an email protocol that also wouldn’t be used.

Telnet is a cleartext protocol used to gain commandline access to a system.

HTTP would commonly be used to pass messages between a controlling server and an IoT device.

Which network topology are you most likely to run across in a large enterprise network?

• Ring topology

• Bus topology

• Full mesh

• Star-bus hybrid

Answer explanation

Ring networks were once common but are much less so now.

You may find a ring network in a service provider network today.

A bus topology is best suited for a smaller network.

Full mesh isn’t a very common topology, in part because of the expense and complexity it brings.

A star-bus hybrid would be common. An enterprise would use multiple switches that were all connected to one another over a bus, while all the endpoints would connect to the switch in a star topology

If you were to see the subnet mask 255.255.252.0, what CIDR notation (prefix) would you use to indicate the same thing?

• /23

• /22

• /21

• /20

Answer explanation

A /23 network would be 255.255.254.0.

A /21 would be 255.255.248.

A /20 would be 255.255.240.0.

Only a /22 would give you a 255.255.252.0 subnet mask.

Which of these addresses would be considered a private address (RFC 1918 address)?

• 172.128.10.5

• 9.10.10.7

• 172.20.128.240

• 250.28.17.10

Answer explanation

The RFC 1918 address blocks are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.

The only address listed that fits into one of those address blocks is 172.20.128.240.

The address block is 172.16.0.0–172.31.255.255