A SOC analyst is investigating a slow network connection and captures traffic on the client and server sides. On the client side, the capture shows TCP segments with sequence numbers and ACK flags. On the server side, the capture shows the same TCP segments but with an additional IP header. The analyst wants to determine whether the issue is at the transport layer or the internet layer. Which observation would indicate a transport-layer issue?

The IP packets show a high number of fragmentation errors.

The TCP segments show a high number of retransmissions and duplicate ACKs.

The Ethernet frames show a high number of CRC errors.

The HTTP requests show a high number of 404 responses.

EC-CouncilSOC Essentials

Domain 1Objective 1

TCP/IP and OSI Models SCE Practice Questions (Page 4)

Part of the Computer Network and Security Fundamentals domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–13 in this domain), expect 1–2 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

6concepts

Questions 16–20

16application · medium
A SOC analyst is investigating a report that a workstation cannot reach a web server. The analyst checks the local ARP cache and sees no entry for the default gateway. Which OSI layer is most likely experiencing the problem?
Select an answer first
17foundation · easy
In the TCP/IP model, which layer is responsible for logical addressing and routing packets between different networks?
Select an answer first
18application · medium
A network administrator is troubleshooting a connectivity issue. The administrator confirms that the workstation has a valid IP address and can ping the default gateway, but cannot reach a server on a remote subnet. Which TCP/IP layer is most likely causing the problem?
Select an answer first
19foundation · easy
Which TCP/IP model layer is responsible for establishing, managing, and terminating sessions between applications, and also handles data formatting and encryption?
Select an answer first
20expert · hard
A SOC analyst is investigating a slow network connection and captures traffic on the client and server sides. On the client side, the capture shows TCP segments with sequence numbers and ACK flags. On the server side, the capture shows the same TCP segments but with an additional IP header. The analyst wants to determine whether the issue is at the transport layer or the internet layer. Which observation would indicate a transport-layer issue?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.

TCP/IP and OSI Models SCE Practice Questions (Page 4)

Questions 16–20

A SOC analyst is investigating a report that a workstation cannot reach a web server. The analyst checks the local ARP cache and sees no entry for the default gateway. Which OSI layer is most likely experiencing the problem?

In the TCP/IP model, which layer is responsible for logical addressing and routing packets between different networks?

A network administrator is troubleshooting a connectivity issue. The administrator confirms that the workstation has a valid IP address and can ping the default gateway, but cannot reach a server on a remote subnet. Which TCP/IP layer is most likely causing the problem?

Which TCP/IP model layer is responsible for establishing, managing, and terminating sessions between applications, and also handles data formatting and encryption?

Keep studying — Computer Network and Security Fundamentals