ISC2-CC - Network Security (24% of the exam) - Section 4.1

Understand computer networking fundamentals, including the OSI and TCP/IP models, IP addressing, and common ports and protocols.

Identify the layers of the OSI and TCP/IP models and the function each performs, and recognise common protocols and their well-known ports - HTTP (80), HTTPS (443), SSH (22), DNS (53), and RDP (3389). Distinguish IPv4 from IPv6 addressing and the role of public versus private address ranges.

OSI modelTCP/IP modelCommon portsIP addressingProtocols

Practice question for this objective

Free sampleNetwork Securitymedium

A support engineer is mapping where the HTTP, DNS and SMTP protocols sit within the four-layer TCP/IP model so she can explain the stack to a new hire. Into which TCP/IP layer do these three protocols fall?

ATransport layer
BApplication layer Correct
CInternet layer
DNetwork access layer

In the TCP/IP model, HTTP, DNS and SMTP are Application-layer protocols that sit above transport and routing. The four-layer TCP/IP model collapses the top OSI layers into a single Application layer, where protocols such as HTTP, DNS and SMTP operate, while transport services and IP routing are provided by the lower Transport and Internet layers.

Why A is wrong: These protocols do rely on TCP or UDP, which makes this tempting, but that reliance is on the Transport layer's services rather than the layer where the protocols themselves live.

Why B is correct: HTTP, DNS and SMTP are all application protocols that generate and interpret user-facing data, so in the TCP/IP model they sit at the Application layer.

Why C is wrong: Traffic is routed at the Internet layer, so it seems plausible, but this layer handles IP addressing and routing, not application protocols.

Why D is wrong: This layer is the foundation of the stack, which can distract, but it deals with physical transmission and framing, not with HTTP, DNS or SMTP.

See more ISC2-CC practice questions, answers explained.

Exam traps in Network Security

Answers that look right on this material and are not. Each one is a distractor from a different question in the ISC2-CC bank for this domain.

8.0.0.0 to 8.255.255.255, a block set aside so organisations can address internal hosts without public registration.
Why it is wrong: This is tempting because it looks like a tidy block, but 8.0.0.0/8 is public address space allocated on the internet, not a private range.
They span 1024 to 49151 and are registered by software vendors for their proprietary server applications.
Why it is wrong: Tempting because this describes a real category, but 1024 to 49151 is the registered port range, not the well-known range.
The TCP/IP model adds a presentation layer that the OSI model lacks, giving it more distinct layers than OSI overall.
Why it is wrong: This reverses the reality; the presentation layer belongs to OSI, and TCP/IP actually has fewer layers, not more.

Examworthy is not affiliated with or endorsed by ISC2. Original, blueprint-aligned practice material only.