wayground logo

Free Printable Worksheets

Font size

S
M
L
XL
Worksheets

OSI Model Quiz

Total questions: 48

Worksheet time: 24mins

Name
Class
Date
1.

Which layer of the OSI model would you investigate first if a network cable appears to be malfunctioning?

a)

Application Layer

b)

Physical Layer

c)

Transport Layer

d)

Data Link Layer

2.

A user reports that they cannot connect to a website, but the network diagnostics indicate that the connection is being established. At which OSI layer might encryption issues, such as SSL/TLS misconfigurations, occur?

a)

Network Layer

b)

Presentation Layer

c)

Transport Layer

d)

Data Link Layer

3.

Which of the following scenarios best illustrates Layer 3 (Network Layer) of the OSI model?

a)

A browser establishes a secure session with a web server.

b)

A switch forwards data to the appropriate MAC address.

c)

Data is broken into packets and routed based on IP addresses.

d)

A user accesses a file via FTP.

4.

You are troubleshooting a network issue where devices in the same local network can communicate, but external websites cannot be accessed. Which OSI layer is most likely causing this problem?

a)

Network Layer

b)

Physical Layer

c)

Session Layer

d)

Application Layer

5.

During a packet capture in Wireshark, you observe that traffic between two devices uses destination and source MAC addresses. Which OSI layer is primarily involved in this communication?

a)

Data Link Layer

b)

Application Layer

c)

Network Layer

d)

Transport Layer

6.

A streaming application buffers frequently, and your analysis indicates that the issue relates to unreliable data delivery. Which OSI layer should be examined to determine if the application is using TCP or UDP?

a)

Transport Layer

b)

Network Layer

c)

Session Layer

d)

Application Layer

7.

An organization is experiencing inconsistent data rendering on its intranet website due to incorrect character encoding. At which OSI layer does this problem most likely occur?

a)

Physical Layer

b)

Session Layer

c)

Presentation Layer

d)

Data Link Layer

8.

A company wants to ensure continuous communication between its offices, even if a single link fails. Which topology would best meet their requirements, and why?

a)

Star, because it provides centralized management.

b)

Bus, because it uses a single communication line.

c)

Ring, because it loops back in case of a severed link.

d)

Mesh, because it provides multiple redundant paths.

9.

Why might a hybrid network topology be advantageous in a large organization with multiple remote sites?

a)

It simplifies the design by using only one topology type.

b)

It allows the organization to combine the benefits of multiple topologies.

c)

It eliminates the need for wireless connectivity.

d)

It avoids the use of access points entirely.

10.

You are troubleshooting a network where IoT devices in a large building communicate through a mesh network. Some devices are offline, but others continue to communicate. Which feature of the mesh topology explains this behavior?

a)

The redundancy of ring connections.

b)

The ability of the network to self-heal.

c)

The use of a central hub for communication.

d)

The direct communication of bus networks.

11.

A small office uses a star topology for its local area network. What would be the most likely consequence if the central hub fails?

a)

Only the devices directly connected to the failed hub would be affected.

b)

The network would lose all connectivity.

c)

Communication between devices would continue via alternate paths.

d)

Data transmission would slow down but not stop.

12.

Why is a bus topology rarely used in modern local area networks, despite its simplicity?

a)

It requires too many redundant connections.

b)

A single cable break can disrupt the entire network.

c)

It is incompatible with wireless technology.

d)

It does not support IoT devices.

13.

In a wide area network that uses a ring topology, how does the network respond when a connection is severed?

a)

All data transmission stops until the connection is repaired.

b)

Traffic is rerouted through other topologies integrated into the network.

c)

The network uses loopback mechanisms to reroute the data around the ring.

d)

The network switches to a bus topology temporarily.

14.

What is the primary advantage of using an ad hoc wireless network in a temporary setup?

a)

It provides centralized control through an access point.

b)

It allows devices to communicate directly without additional infrastructure.

c)

It ensures consistent performance over long distances.

d)

It supports the highest data transfer speeds.

15.

Which port number is used by File Transfer Protocol (FTP)?

a)

22

b)

20/21

c)

25

d)

80

16.

Secure Shell (SSH) operates on which port?

a)

443

b)

53

c)

22

d)

110

17.

Which protocol uses port 25 for communication?

a)

Secure File Transfer Protocol (SFTP)

b)

Simple Mail Transfer Protocol (SMTP)

c)

Domain Name System (DNS)

d)

Post Office Protocol (POP3)

18.

The Domain Name System (DNS) operates on which port?

a)

67/68

b)

143

c)

53

d)

443

19.

Hypertext Transfer Protocol Secure (HTTPS) communicates over which port?

a)

443

b)

110

c)

80

d)

143

20.

Which port numbers are associated with the Dynamic Host Configuration Protocol (DHCP)?

a)

389

b)

67/68

c)

514

d)

161/162

21.

The Lightweight Directory Access Protocol (LDAP) operates on which port?

a)

389

b)

993

c)

3389

d)

587

22.

Which protocol uses port 3389 for communication?

a)

Remote Desktop Protocol (RDP)

b)

File Transfer Protocol (FTP)

c)

Secure Shell (SSH)

d)

Network Time Protocol (NTP)

23.

An organization experiences a sudden network outage caused by thousands of compromised devices attacking a single server simultaneously. Which action would best mitigate this distributed denial-of-service (DDoS) attack?

a)

Update the antivirus signatures on all devices in the network.

b)

Block communication with the command-and-control (C&C) server at the firewall.

c)

Replace the affected server with a new system.

d)

Shut down all network connections to avoid further attacks.

24.

A network administrator notices unusual spikes in bandwidth usage caused by unknown devices sending excessive requests to a single service. Which strategy would best help the administrator identify the cause of this issue?

a)

Deploy a network intrusion detection system (NIDS).

b)

Isolate the affected devices from the network.

c)

Monitor traffic patterns for connections to potential botnet command-and-control (C&C) servers.

d)

Update antivirus signatures on all devices.

25.

During a post-incident analysis of a denial-of-service attack, it was found that a Trojan horse was used to convert internal systems into bots. Which preventive measure would have most effectively reduced the risk of this attack?

a)

Use host-based intrusion prevention systems (HIPS) to detect unusual activity.

b)

Perform regular system patching to close vulnerabilities.

c)

Implement strict access control policies for external traffic.

d)

Train users to identify phishing attempts.

26.

An attacker performs ARP poisoning on a local network to intercept communications between a user's device and the router. What would be the most effective way to detect and mitigate this type of attack?

a)

Monitor ARP table entries for unexpected changes in MAC addresses.

b)

Deploy a managed switch to monitor network traffic.

c)

Use firewalls to block untrusted traffic.

d)

Restrict physical access to the network infrastructure.

27.

If a DNS poisoning attack successfully redirects a user to a malicious server, which preventive measure would most effectively stop this from happening again?

a)

Use DNSSEC to validate DNS responses.

b)

Deploy DNS filtering tools to block known malicious sites.

c)

Implement a whitelist of trusted DNS servers.

d)

Restrict access to DNS configurations to authorized administrators.

28.

An attacker modifies the host file on a victim's computer to redirect web traffic to a malicious site. Which defensive strategy would prevent this type of manipulation?

a)

Configure firewalls to allow only DNS traffic to trusted servers.

b)

Implement read-only permissions for the host file and monitor for changes.

c)

Install antivirus software to detect malicious activity.

d)

Implement application whitelisting to block unauthorized changes.

29.

An attacker exploits switch spoofing to gain access to multiple VLANs. What configuration change would most effectively prevent this type of attack?

a)

Use a native VLAN for trunk ports.

b)

Enable automatic trunk negotiation for all ports.

c)

Manually configure each switch port as either an access or trunk port.

d)

Restrict VLANs to communicate only with authorized devices.

30.

In a double tagging attack, an attacker crafts a frame with two VLAN tags. What makes this attack effective, and how can it be mitigated?

a)

It exploits native VLANs, and mitigation involves disabling native VLANs or forcing tagging for all traffic.

b)

It uses trunk ports to access multiple VLANs, and mitigation involves enabling automatic configuration.

c)

It modifies ARP tables, and mitigation involves disabling VLAN tagging entirely.

d)

It relies on inter-VLAN routing, and mitigation involves using strict access controls.

31.

An attacker gains physical access to a switch and uses switch spoofing to communicate with devices across VLANs. Why is this attack considered dangerous, and what is the best defense against it?

a)

It allows unauthorized inter-VLAN communication, and using encryption for VLANs is the best defense.

b)

It grants access to all VLANs, and securing physical access to switches is the first line of defense.

c)

It relies on ARP poisoning, and using a firewall at the VLAN level is the best defense.

d)

It disrupts network traffic, and implementing VLAN trunk pruning is the best defense.

32.

An attacker performs ARP spoofing by sending a fake ARP response to a device, making the device believe the attacker is the router. What would be the best method to prevent this type of attack?

a)

Use firewalls to block IP address spoofing.

b)

Enable dynamic ARP inspection on the switch.

c)

Disable the ARP protocol on all devices.

d)

Use MAC filtering to block untrusted devices.

33.

A security administrator notices that a device on the network is pretending to use another device’s MAC address to bypass access controls. What is the most effective way to prevent this type of spoofing attack?

a)

Configure IP-based access control lists on the network.

b)

Restrict MAC address access using static entries on switches.

c)

Enable DHCP snooping to detect spoofed MAC addresses.

d)

Use DNSSEC to validate all communication on the network.

34.

A firewall is configured to block traffic from spoofed IP addresses. Which type of attack would this configuration most effectively mitigate?

a)

DNS poisoning

b)

ARP spoofing

c)

Distributed denial of service (DDoS)

d)

Man-in-the-middle attack

35.

An attacker sets up a rogue DHCP server on a network, causing devices to receive incorrect IP addresses. What is the most effective method to detect and prevent this issue?

a)

Use a firewall to block DHCP traffic on the network.

b)

Enable DHCP snooping on switches to monitor and block unauthorized DHCP servers.

c)

Use IP-based access control lists to restrict network access.

d)

Configure devices to only accept static IP addresses.

36.

An organization detects a rogue access point in their office. Which strategy would best prevent unauthorized access through such devices?

a)

Perform regular wireless surveys to identify unauthorized access points.

b)

Use a virtual private network (VPN) for all internal communications.

c)

Configure DHCP snooping to block rogue access points.

d)

Enable 802.1X authentication on all network connections.

37.

You notice a wireless network with the same SSID as your company’s network but with stronger signal strength. How should you protect your devices from this wireless evil twin?

a)

Avoid connecting to any wireless network with your company’s SSID.

b)

Ensure all communications use encryption, such as HTTPS or a VPN.

c)

Change your network’s SSID to avoid interference.

d)

Configure devices to block connections to unfamiliar access points.

38.

You are troubleshooting connectivity to a remote server and need to check if it is reachable over the network. Which command would you use?

a)

traceroute

b)

nslookup

c)

ping

d)

tcpdump

39.

You need to display the current IP configuration, including the assigned IP address, subnet mask, and default gateway on a Windows machine. Which command would you use?

a)

netstat

b)

ipconfig

c)

route

d)

arp

40.

You suspect there is an issue with the DNS resolution of a domain name. Which tool would help you query the DNS server to resolve the domain to an IP address?

a)

arp

b)

nslookup

c)

tcpdump

d)

hostname

41.

You want to determine the path that packets take to reach a remote host and identify any latency along the route. Which command would you use?

a)

traceroute or tracert

b)

ipconfig

c)

nmap

d)

telnet

42.

You want to view the MAC address of a device associated with a specific IP address on your local network. Which command would you use?

a)

route

b)

arp

c)

ping

d)

tcpdump

43.

You need to monitor active network connections and open ports on your system. Which command would you use?

a)

netstat

b)

hostname

c)

route

d)

ifconfig

44.

To verify the hostname of your system, which command would you use?

a)

arp

b)

traceroute

c)

hostname

d)

nmap

45.

To modify or view the routing table of a system, which command would you use?

a)

route

b)

ping

c)

tcpdump

d)

dig

46.

You need to remotely connect to another system for troubleshooting purposes. Which command would you use?

a)

tcpdump

b)

telnet

c)

netstat

d)

ifconfig

47.

To capture and analyze packets sent and received on your network interface, which tool would you use?

a)

tcpdump

b)

ping

c)

arp

d)

traceroute

48.

To scan for open ports and detect services running on a target machine, which command-line tool would you use?

a)

hostname

b)

ping

c)

nmap

d)

route