N10-009 - Networking Concepts (23% of the exam) - Section 1.2

Compare and contrast networking appliances, applications, and functions, and explain common ports, protocols, services, and traffic types.

Compare the role of routers, switches, firewalls, load balancers, IDS/IPS, proxies, and wireless access points, and distinguish hardware appliances from their virtual and software equivalents. Recall the well-known ports and transport protocols for core services - SSH 22, DNS 53, HTTP 80, HTTPS 443, RDP 3389 - and match each protocol to its use case and TCP-versus-UDP behaviour.

Network appliancesWell-known portsTCP vs UDPFirewall and IDS/IPS

Practice question for this objective

Free sampleNetworking Conceptseasy

A firewall administrator writes a rule that permits traffic destined for TCP port 443 and denies traffic destined for TCP port 80. The device reaches this decision by reading the port numbers in each segment header. At which OSI layer is this rule operating?

ALayer 2, the data link layer
BLayer 4, the transport layer Correct
CLayer 3, the network layer
DLayer 7, the application layer

Filtering traffic by TCP or UDP port number is a transport-layer function, distinct from IP-based filtering at the network layer. Port numbers such as 443 and 80 are fields inside the TCP segment header, so any filter that permits or denies traffic by port number is acting at the transport layer.

Why A is wrong: Frames carry MAC addresses at the data link layer, but this rule reads TCP port numbers rather than hardware addresses, so Layer 2 is wrong.

Why B is correct: TCP port numbers are contained in the transport-layer segment header, so a rule matching port 443 or port 80 operates at Layer 4.

Why C is wrong: Firewalls can filter on destination IP at the network layer, which makes Layer 3 tempting, but ports 443 and 80 are transport-layer constructs, not network addresses.

Why D is wrong: Ports 443 and 80 carry HTTPS and HTTP, so the application layer looks plausible, but the rule inspects the port number in the segment header rather than the application data itself.

See more N10-009 practice questions, answers explained.

Exam traps in Networking Concepts

Answers that look right on this material and are not. Each one is a distractor from a different question in the N10-009 bank for this domain.

Because UDP negotiates a keepalive during its three-way handshake, and the port 514 entries expire whenever that handshake is not renewed in time.
Why it is wrong: Tempting because keepalives sound plausible, but UDP has no three-way handshake to negotiate anything; the timeout comes from the firewall's own idle timer.
Telnet uses TCP port 22 with encryption, while SSH uses TCP port 23 in cleartext.
Why it is wrong: The ports are the right pair but assigned backwards; 22 is encrypted SSH and 23 is cleartext Telnet, not the reverse.
TCP would cut overhead because it omits the per-datagram checksum that UDP requires, which lowers the latency seen while the link is congested.
Why it is wrong: Tempting because TCP can feel efficient, but TCP adds header and acknowledgement overhead and both protocols carry a checksum, so latency would rise, not fall.

Examworthy is not affiliated with or endorsed by CompTIA. Original, blueprint-aligned practice material only.