Free Network-and-Security-Foundation Practice Test Questions and Answers (2026)

The netstat (network statistics) command is a command-line utility used to display network connections, routing tables, and various network interface statistics. Its primary function is to show active TCP and UDP connections, listening ports, and the processes using them. Running netstat (often with flags like -a for all sockets, -t for TCP, -u for UDP, -n for numeric addresses) directly provides the list of active connections that the user requires for troubleshooting. While newer tools like ss are often recommended, netstat remains a fundamental and widely available tool for this task.

A. nslookup: This is a utility for querying Domain Name System (DNS) servers to resolve hostnames, not for listing active connections.

C. dig: Like nslookup, dig (Domain Information Groper) is a tool for interrogating DNS servers and does not display network connections.

D. ifconfig: This command is used to display or configure a system's network interfaces (e.g., IP address, netmask), not to list active connections.

---

1. The Linux man-pages project. netstat(8) — Linux manual page. "netstat - Print network connections

routing tables

interface statistics

masquerade connections

and multicast memberships." Retrieved from https://man7.org/linux/man-pages/man8/netstat.8.html (Section: NAME).

2. Red Hat Customer Portal. RHEL 7 Networking Guide. "Chapter 33. Displaying Network Sockets with ss and netstat". This official vendor documentation describes netstat as a tool for displaying "information about network connections

routing tables

and network interfaces."

3. Stanford University

CS 144: Introduction to Computer Networking. Lab 0: Networking Warmup. The course materials introduce fundamental networking tools

describing netstat -pant as the command to "list all listening and established TCP sockets with the associated process name." This confirms its use for viewing active connections in an academic context.

The scenario requires a cloud service model that provides base-level computing resources (servers, storage, networking) without the need to purchase physical hardware, while granting the company complete control over the operating system (OS) and software. Infrastructure as a Service (IaaS) is the only model that meets these criteria. IaaS offers virtualized infrastructure components, allowing the customer to deploy and run their own software, including the OS and applications. The cloud provider manages the underlying physical hardware, but the customer retains control over the virtualized environment, including the OS.

A. Software as a Service (SaaS) provides ready-to-use applications, offering no control over the underlying OS or infrastructure.

B. Function as a Service (FaaS) is a serverless model where the provider manages the OS, abstracting it entirely from the user.

D. Platform as a Service (PaaS) provides a development platform where the provider manages the OS, limiting user control to applications.

---

1. Mell

P.

& Grance

T. (2011). The NIST Definition of Cloud Computing (Special Publication 800-145). National Institute of Standards and Technology.

Page 2

Section "Infrastructure as a Service (IaaS)": "The capability provided to the consumer is to provision processing

storage

networks

and other fundamental computing resources where the consumer is able to deploy and run arbitrary software

which can include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure but has control over operating systems

storage

and deployed applications..." This directly supports the choice of IaaS for control over the OS.

2. Microsoft Azure Documentation. (n.d.). What is IaaS?

Section "What is IaaS?": "The cloud computing service provider manages the infrastructure

while you purchase

install

configure

and manage your own software—operating systems

middleware

and applications." This official vendor documentation confirms that in the IaaS model

the customer manages the operating system.

3. Armbrust

M.

Fox

A.

Griffith

R.

Joseph

A. D.

Katz

R.

Konwinski

A.

... & Zaharia

M. (2009). Above the Clouds: A Berkeley View of Cloud Computing (Technical Report No. UCB/EECS-2009-28). University of California

Berkeley.

Page 3

Section 3.1 "Levels of Virtualization": The report describes Infrastructure-as-a-Service (IaaS) as a model where the cloud provider offers virtual machines (VMs). It states

"A user of IaaS can run any software they can run on a physical machine

including an operating system and applications." This academic source validates that IaaS provides the required level of control over the OS.

Infrastructure as a Service (IaaS) is the cloud service model that provides virtualized computing resources over the internet. With IaaS, the consumer can provision fundamental resources like processing (virtual machines), storage, and networks. The key characteristic that fits the company's needs is that the consumer has control over the operating systems, storage, and deployed applications. This allows the company to choose and configure the OS on each virtual machine, which is not possible with other models like PaaS or SaaS where the provider manages the OS.

A. Function as a Service (FaaS): This is a serverless model for running event-triggered code. The user does not manage or even see the underlying virtual machines or operating systems.

C. Platform as a Service (PaaS): The provider manages the underlying infrastructure, including the operating systems. The customer only manages their applications and data, not the OS configuration.

D. Software as a Service (SaaS): This model delivers a complete software application. The user has no control over the infrastructure, platform, or OS; they only use the provided software.

1. Mell

P.

& Grance

T. (2011). The NIST Definition of Cloud Computing (Special Publication 800-145). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-145

Page 2

Section "Service Models": Defines Infrastructure as a Service (IaaS) as providing the capability to "provision processing

storage

networks

and other fundamental computing resources where the consumer is able to deploy and run arbitrary software

which can include operating systems and applications... The consumer... has control over operating systems

storage

and deployed applications." This directly supports the selection of IaaS.

2. Armbrust

M.

Fox

A.

Griffith

R.

Joseph

A. D.

Katz

R.

Konwinski

A.

... & Zaharia

M. (2009). Above the Clouds: A Berkeley View of Cloud Computing (Technical Report No. UCB/EECS-2009-28). EECS Department

University of California

Berkeley.

Page 3

Section 2.1 "Classes of Utility Computing": Describes IaaS providers as offering "virtual machines (VMs) and storage." It contrasts this with PaaS

where the provider manages the OS and servers

and SaaS

which provides complete applications. This academic source confirms that control over VMs and their OS is a defining feature of IaaS.

3. Microsoft Azure Documentation. (n.d.). What is IaaS?. Microsoft. Retrieved from the official Microsoft Azure website.

Section "What is IaaS?": States

"The cloud computing service provider manages the infrastructure

while you purchase

install

configure

and manage your own software—operating systems

middleware

and applications." This official vendor documentation aligns with the company's requirement to choose and configure operating systems.

Social engineering is a type of attack that relies on human interaction and psychological manipulation to trick individuals into making security mistakes or giving away sensitive information. The scenario describes an attacker using impersonation (a forged ID card) and deception to manipulate an employee. This is a classic example of a social engineering tactic, as the attack vector is the human element rather than a technical vulnerability in software or hardware.

A. Brute-force attack: This is an automated, computational attack that tries all possible password combinations to gain access, not an attack based on human deception.

B. Man-in-the-middle attack: This is a network eavesdropping attack where an attacker intercepts and potentially alters communications between two parties, which is not what is described.

D. Pharming: This is a technical attack that redirects a website's traffic to a fraudulent site to steal credentials, not an attack involving in-person impersonation.

1. National Institute of Standards and Technology (NIST). (2021). NIST Glossary - Social Engineering. CSRC. Retrieved from https://csrc.nist.gov/glossary/term/socialengineering.

Reference Point: The glossary defines social engineering as "The act of deceiving an individual into revealing sensitive information

obtaining unauthorized access

or committing fraud by associating with the individual to gain confidence and trust." This directly supports the correct answer. The glossary also provides distinct definitions for brute-force

man-in-the-middle

and pharming that align with the explanations for the incorrect options.

2. Grassi

P. A.

Garcia

M. E.

& Fenton

J. L. (2017). NIST Special Publication 800-63-3: Digital Identity Guidelines. National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-63-3

Reference Point: Section 5.2.2

"Threats

" discusses social engineering as a primary method attackers use to trick legitimate users into disclosing authenticators or other private information

which is precisely what occurs in the scenario.

3. Saltzer

J. H.

& Kaashoek

M. F. (2009). Principles of Computer System Design: An Introduction. Morgan Kaufmann. (Material often used in MIT OpenCourseWare

e.g.

6.033 Computer System Engineering).

Reference Point: Chapter 11

"Security and Protection

" Section 11.2.2

"Attacks

" describes social engineering as a non-technical attack that persuades or tricks an authorized user into revealing information or taking a specific action. The use of a forged ID is a form of persuasion and trickery.

A Wireless Local Area Network (WLAN) is a type of local area network that uses high-frequency radio waves to communicate and transmit data, providing wireless connectivity within a limited geographic area like an office building, home, or library. The scenario describes patrons using mobile devices to connect to the internet within a library, which is the primary use case for a WLAN. This network infrastructure, commonly known as Wi-Fi, is based on the IEEE 802.11 standards and allows multiple users to access network resources without physical cables.

A. SAN: A Storage Area Network is a dedicated, high-speed network for connecting servers to storage devices, not for providing general internet access to end-users.

B. MAN: A Metropolitan Area Network covers a large geographic area like a city or a large campus, which is a much larger scale than a single library building.

C. PAN: A Personal Area Network connects devices within an individual's immediate workspace, typically using technologies like Bluetooth, not a building-wide access network.

1. Kurose

J. F.

& Ross

K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. In Section 1.3.1

the text describes wireless LANs (based on IEEE 802.11 technology) as a prevalent access network technology in "universities

business offices

cafes

airports

homes

and... libraries."

2. IEEE Computer Society. (2021). IEEE Standard for Information Technology--Telecommunications and information exchange between systems Local and metropolitan area networks--Specific requirements Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications (IEEE Std 802.11™-2020). The standard's scope (Section 1.1) defines its purpose as providing "wireless connectivity for fixed

portable

and moving stations within a local area."

3. Cisco. (n.d.). What Is a WLAN (Wireless Local Area Network)? Cisco.com. Retrieved from Cisco's official documentation

which defines a WLAN as "a wireless computer network that links two or more devices using wireless communication to form a local area network (LAN) within a limited area such as a home

school

computer laboratory

campus

or office building."

4. Forouzan

B. A. (2013). Data Communications and Networking (5th ed.). McGraw-Hill. In Chapter 1

Section 1.3

the text distinguishes between network types

defining a LAN as being "usually privately owned and links the devices in a single office

building

or campus

" with WLAN being its wireless variant. It defines a MAN as covering an "entire city."

The scenario describes an attacker compromising one computer to use it as a base for attacking other systems. This initial compromised machine serves as a launch point or "stepping stone." This technique allows the attacker to obscure their true origin, making it harder to trace the attack back to them. The primary purpose of compromising this first machine is not to harm it directly but to leverage its resources and network position for a broader campaign.

A. Denial of availability: This is a type of attack outcome (e.g., DDoS), which might be launched from the compromised machine, but it is not the purpose of the initial compromise itself.

B. Data export: This refers to data exfiltration. The scenario's focus is on using the machine to attack others, not on stealing data from the initial victim.

C. Data modification: This involves altering data to compromise its integrity. The described purpose is to use the computer as a tool, not to modify its data.

---

1. National Institute of Standards and Technology (NIST)

Special Publication 800-61 Rev. 2

Computer Security Incident Handling Guide

August 2012.

Section 2.3.2

Attack Vectors

discusses how attackers compromise hosts to use them as platforms for launching attacks against other targets. This establishes the concept of using a compromised system as a launch point.

2. He

T.

& Wu

S. F. (2007). A Survey of Stepping-Stone Detection Techniques. IEEE Communications Surveys & Tutorials

9(1)

73-87.

Abstract & Section I. Introduction: This peer-reviewed article explicitly defines the methodology: "Attackers often launch attacks through a chain of intermediate hosts

called stepping-stones

to hide their identity and location." This directly corresponds to the "launch point" concept.

DOI: https://doi.org/10.1109/COMST.2007.358974

3. MIT OpenCourseWare

6.858 Computer Systems Security

Fall 2014.

Lecture 1: Introduction & Threat Models: The lecture materials discuss the typical lifecycle of an attack

which includes establishing an initial foothold (compromising a machine) and then using that access to pivot or launch further attacks within a network or against external targets. This compromised host acts as the launch point for subsequent phases.

Confidentiality is the security principle dedicated to preventing the unauthorized disclosure of information. Passive attacks, such as eavesdropping or traffic analysis, are designed to intercept and observe data in transit or at rest without altering it. The primary goal of such attacks is to steal sensitive information. Therefore, confidentiality, often implemented through measures like encryption, is the specific tenet of the CIA triad that directly counters the threat of data interception by ensuring that even if data is stolen, it remains unreadable and unusable to unauthorized parties.

A. Adaptation: This is not a core tenet of the internationally recognized CIA (Confidentiality, Integrity, Availability) security triad.

C. Availability: This principle ensures that information and systems are accessible to authorized users when needed, which addresses threats like Denial-of-Service, not data theft.

D. Integrity: This principle ensures that data has not been altered or destroyed in an unauthorized manner, which primarily counters active attacks involving data modification.

1. National Institute of Standards and Technology (NIST). (2020). Special Publication (SP) 800-53 Rev. 5

Security and Privacy Controls for Information Systems and Organizations. Page 231 (Appendix F). Retrieved from https://doi.org/10.6028/NIST.SP.800-53r5. The document defines Confidentiality as "Preserving authorized restrictions on information access and disclosure

including means for protecting personal privacy and proprietary information."

2. Shirey

R. (2007). RFC 4949

Internet Security Glossary

Version 2. The Internet Society. Retrieved from https://doi.org/10.17487/RFC4949.

Page 61 defines Confidentiality as "The property that information is not made available or disclosed to unauthorized individuals

entities

or processes."

Page 213 defines a passive attack as an attack where the goal is to "obtain information that is being transmitted

" directly linking it to a breach of confidentiality.

3. Saltzer

J. H.

& Schroeder

M. D. (1975). The Protection of Information in Computer Systems. Proceedings of the IEEE

63(9)

1278–1308. https://doi.org/10.1109/PROC.1975.9939. This foundational academic paper discusses the principle of Confidentiality (referred to as secrecy) as a primary goal in information protection

distinct from integrity and availability.

Credential stuffing is an automated cyberattack where attackers use lists of exposed usernames and passwords, typically sourced from data breaches, to attempt to log in to other unrelated services. The attack's effectiveness hinges on the common user habit of reusing the same credentials across multiple online accounts. The scenario describes an attacker using a "list of commonly used access credentials," which is the defining characteristic of a credential stuffing attack against an online account. This method differs from a dictionary attack, which targets a single account with many passwords.

A. Phishing: This attack deceives users into voluntarily disclosing their credentials, rather than using a pre-existing list to force access.

B. Dictionary attack: This method attempts to guess a password for a single known username by trying words from a list (a dictionary).

D. Social engineering: This is a broad category of attacks that manipulate people; the described attack is automated, not based on direct human manipulation.

1. Open Web Application Security Project (OWASP). OWASP Automated Threats to Web Applications - OAT-008 Credential Stuffing. OWASP Foundation. Retrieved from https://owasp.org/www-project-automated-threats-to-web-applications/assets/oats/EN/OAT-008CredentialStuffing.html.

Reference Point: The "Description/Summary" section defines credential stuffing as "mass login attempts against a target web application using lists of usernames and passwords (credentials) that have been stolen from other web sites."

2. National Institute of Standards and Technology (NIST). NIST Special Publication 800-63B

Digital Identity Guidelines: Authentication and Lifecycle Management. June 2017.

Reference Point: Section 5.1.1.2

Paragraph 10

states: "Verifiers SHOULD check submitted passwords against a list of commonly-used

expected

or compromised passwords." This acknowledges the threat posed by compromised credentials used in attacks like credential stuffing.

3. Carnegie Mellon University

Software Engineering Institute (SEI). Defining Credential Stuffing. CERT Division Blog

April 2

2019.

Reference Point: The article defines the attack: "Credential stuffing is the automated injection of breached username/password pairs into website login forms in order to fraudulently gain access to user accounts." It explicitly differentiates it from brute-force and dictionary attacks.

The scenario describes Role-based Access Control (RBAC). In this model, access permissions are assigned to predefined roles, and users are then assigned to those roles based on their job function or group membership. A department is a classic example of a role. All users within a specific department (e.g., "Sales," "Engineering") inherit the permissions associated with that role. This simplifies administration by managing permissions for groups rather than for each individual user, which directly matches the practice described.

A. Attribute-based: ABAC uses policies that evaluate multiple attributes (e.g., user clearance, resource sensitivity, location, time of day) for more granular, dynamic access decisions, which is more complex than the described model.

C. Context-based: This model considers real-time contextual factors like the state of the system, location, or time of day to make an access decision, none of which are mentioned.

D. Discretionary: In DAC, the owner of a resource grants permissions to other users. The scenario implies a centralized, company-wide policy, not decisions made by individual resource owners.

1. National Institute of Standards and Technology (NIST). (2013). Special Publication 800-162: Guide to Attribute Based Access Control (ABAC) Definition and Considerations. Section 2.3

"Comparison of ABAC to Other Access Control Models

" states

"In the RBAC model

roles are created for various job functions in an organization... Permissions to perform certain operations are assigned to specific roles." This directly supports using a department as a role.

2. Sandhu

R. S.

Coyne

E. J.

Feinstein

H. L.

& Youman

C. E. (1996). Role-based access control models. IEEE Computer

29(2)

38-47. In Section 2

"The RBAC Framework

" the paper defines roles as corresponding to job functions or work-groups within an organization

such as a department. (DOI: https://doi.org/10.1109/2.485845)

3. Ferraiolo

D. F.

& Kuhn

D. R. (1992). Role-Based Access Control. Proceedings of the 15th National Computer Security Conference. The foundational paper on RBAC defines the model where permissions are associated with roles

and users acquire permissions by being members of roles. A department is a direct implementation of such a role. (Available via NIST CSRC publications).

The General Data Protection Regulation (GDPR) establishes a comprehensive framework for data protection, granting individuals significant rights over their personal data. Key among these are the rights of the data subject, as outlined in Chapter 3 of the regulation. This includes the right of access (Article 15), which allows individuals to obtain a copy of their personal data, and the right to erasure, also known as the 'right to be forgotten' (Article 17), which allows them to request the deletion of their data under specific circumstances. The right to data portability (Article 20) further empowers individuals to receive and reuse their data.

B. GDPR mandates a lawful basis for processing data, such as consent, but it does not require companies to financially compensate individuals for data sales.

C. GDPR requires implementing appropriate technical security measures (Article 32) but does not mandate the public disclosure of specific software, which could compromise security.

D. GDPR requires notification for data breaches and transparency about processing activities, not for every single time an employee views personal information internally.

1. Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation).

Article 15

"Right of access by the data subject": "The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed

and

where that is the case

access to the personal data..."

Article 17

"Right to erasure (‘right to be forgotten’)": "The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay..."

Article 20

"Right to data portability": "The data subject shall have the right to receive the personal data concerning him or her

which he or she has provided to a controller

in a structured

commonly used and machine-readable format..."

2. University of California

Berkeley

Privacy Office. "Key Requirements of the GDPR." This resource outlines the fundamental rights of data subjects under GDPR

stating

"Individuals have the right to: ...Access their personal data... Have their data erased (the right to be forgotten)."

3. Voigt

P.

& Von dem Bussche

A. (2017). The EU General Data Protection Regulation (GDPR): A Practical Guide. Springer. DOI: https://doi.org/10.1007/978-3-319-57959-7.

Chapter 10

"Rights of the Data Subject

" pp. 117-158: This chapter provides a detailed academic analysis of the rights granted to individuals

including access

erasure

and portability

confirming them as core requirements.

A broadband router is a networking device designed for home and small office (SOHO) environments. Its primary function is to share a single broadband internet connection among multiple computers. It integrates the capabilities of a router (to connect to the internet), a network switch (to connect local computers together via Ethernet cables), and often a wireless access point. This single device fulfills both requirements of connecting computers to each other on a local network and connecting that entire network to the internet.

A. Inter-provider border router: This router is used by Internet Service Providers (ISPs) to connect their network to other ISP networks, not for end-user local networking.

B. Subscriber edge router: This is typically the router on the ISP's side of the network that connects directly to the customer's premises equipment.

D. Core router: This is a high-capacity router that operates within the backbone of a large network, forwarding traffic between major network segments, not connecting end-user devices.

1. Kurose

J. F.

& Ross

K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. In Chapter 1

Section 1.3

the text describes the typical home network architecture where a "home router" (a common broadband router) connects internal devices to each other and to the ISP's modem for internet access.

2. Cisco. (n.d.). What Is a Router?. Cisco.com. This official vendor documentation distinguishes between different router types

describing small business or home routers (i.e.

broadband routers) as devices that connect multiple devices to the internet

contrasting them with high-performance service provider core and edge routers.

3. Comer

D. E. (2015). Computer Networks and Internets (6th ed.). Pearson. Chapter 19

"Internet Routing

" discusses the hierarchy of routers. It implicitly differentiates between the large

powerful routers forming the internet's core and the small routers used at the edge to connect a site or home to an ISP. The device in the question is an edge device

specifically a broadband router.

The scenario describes implementing encryption standards for a network protocol. The primary purpose of encryption is to convert data into a coded format (ciphertext) to prevent unauthorized access. This directly addresses the principle of Confidentiality, which is concerned with preventing the unauthorized disclosure of information. By ensuring network protocols meet encryption standards, the company is protecting the secrecy of the data as it travels across the network, making it unreadable to anyone without the proper decryption key.

A. Integrity: Integrity ensures data is not altered without authorization. While some cryptographic methods provide integrity, its primary tool is hashing, not just encryption.

B. Consistency: Consistency is a principle related to database systems (ACID properties) and is not a component of the information security CIA triad.

C. Availability: Availability ensures that systems and data are accessible when needed. Encryption does not provide availability; lost keys can actually prevent access.

1. National Institute of Standards and Technology (NIST). (2020). Security and Privacy Controls for Information Systems and Organizations (NIST Special Publication 800-53

Revision 5). U.S. Department of Commerce. In Appendix D

"Glossary

" confidentiality is defined as "Preserving authorized restrictions on information access and disclosure..." Encryption is a primary mechanism for achieving this. (See page 218).

2. Saltzer

J. H.

& Schroeder

M. D. (1975). The Protection of Information in Computer Systems. Proceedings of the IEEE

63(9)

1278–1308. This foundational paper outlines security principles

where confidentiality is described as the prevention of unauthorized disclosure of information

a goal directly served by encryption. (See Section I.A.1

page 1279).

3. Massachusetts Institute of Technology (MIT) OpenCourseWare. (2018). 6.033 Computer System Engineering

Spring 2018. Lecture 19: Security. The lecture notes explicitly define confidentiality as preventing unauthorized disclosure of information and list encryption as the primary mechanism to achieve it. (See slide 4

"Security goals").

The dig (Domain Information Groper) command is a standard and powerful command-line tool in Linux used for interrogating Domain Name System (DNS) servers. Its primary purpose is to perform DNS lookups and return detailed information from the name server, including A records, MX records, and other DNS data. For an administrator troubleshooting DNS resolution, dig is the most appropriate and direct tool as it provides comprehensive output specifically tailored for diagnosing DNS issues.

A. traceroute: This command is used to trace the network path (route) packets take to a destination, not to test DNS resolution directly.

B. netstat: This command displays network connections, routing tables, and interface statistics; it does not perform DNS queries for troubleshooting.

D. ifconfig: This command is used to view and configure network interface parameters, such as IP addresses, and is not used for DNS lookups.

1. University Courseware:

MIT OpenCourseWare

6.033 Computer System Engineering

Spring 2018

Recitation 10: Naming. The notes explicitly introduce dig as the tool for querying the DNS. "To query the DNS

we can use the dig command." (Section 2

Paragraph 1).

Available at: https://ocw.mit.edu/courses/6-033-computer-system-engineering-spring-2018/resources/mit6033s18rec10/

2. Official Vendor Documentation:

Red Hat Enterprise Linux 8 Documentation

Configuring and managing networking

Chapter 36. Analyzing network traffic. The documentation lists dig as a primary utility for DNS troubleshooting. "The dig utility sends a DNS query to a name server and displays the result." (Section 36.2.1. Querying DNS records using dig).

Available at: https://access.redhat.com/documentation/en-us/redhatenterpriselinux/8/html/configuringandmanagingnetworking/analyzing-network-trafficconfiguring-and-managing-networking

3. Official Linux Documentation (Man Page):

The Linux man-pages project

dig(1). The official manual page describes the tool's function. "dig (domain information groper) is a flexible tool for interrogating DNS name servers. It performs DNS lookups and displays the answers that are returned from the name server(s) that were queried." (NAME section).

Available at: https://man7.org/linux/man-pages/man1/dig.1.html

The Internet Control Message Protocol (ICMP) is a supporting protocol in the Internet Protocol (IP) suite. It operates at the Network Layer (Layer 3) of the OSI model. ICMP is not used for exchanging data between end systems but rather for sending error messages and operational information indicating, for example, that a requested service is not available or that a host or router could not be reached. Because ICMP messages are encapsulated directly within IP datagrams and are integral to the function of IP (e.g., path discovery, error reporting), it is fundamentally a Network Layer protocol.

A. Transport: The Transport Layer (Layer 4) is responsible for end-to-end communication using protocols like TCP and UDP, not for network-level error reporting.

B. Session: The Session Layer (Layer 5) establishes, manages, and terminates connections between applications, a function unrelated to ICMP's network control purpose.

D. Application: The Application Layer (Layer 7) provides network services directly to user applications (e.g., HTTP, FTP). ICMP supports the underlying network, not the applications themselves.

---

1. Postel

J. (1981). RFC 792: Internet Control Message Protocol. Internet Engineering Task Force (IETF).

Section: "Introduction

" Paragraph 2.

Content: "ICMP

uses the basic support of IP as if it were a higher level protocol

however

ICMP is actually an integral part of IP

and must be implemented by every IP module." This establishes ICMP as an essential component of IP

which resides at the Network Layer.

Link: https://doi.org/10.17487/RFC0792

2. Cisco Systems

Inc. (2001). Internetworking Technology Handbook: Internet Protocols.

Section: "Chapter 45: Internet Protocols

" Figure 45-1 "Internet Protocol Suite and the OSI Reference Model."

Content: The official diagram in this vendor documentation explicitly maps ICMP alongside IP in the Network Layer of the OSI model.

3. Kurose

J. F.

& Ross

K. W. (2017). Computer Networking: A Top-Down Approach (7th ed.). Pearson.

Section: Chapter 4

"The Network Layer: Data Plane

" Section 4.4.1 "The Internet Control Message Protocol (ICMP)."

Content: The text states

"ICMP is often considered part of IP

but architecturally it lies just above IP

as ICMP messages are carried inside IP datagrams... ICMP messages are used by hosts and routers to communicate network-layer information to each other." This places it firmly within the Network Layer's scope.

The scenario describes the implementation of role-based permissions, a core mechanism of access control. This directly addresses the concept of authorization. Authorization is the process that determines what permissions an authenticated entity (a user or system) has for accessing resources or performing actions. By assigning permissions based on job roles, the company is explicitly defining and enforcing what each user is allowed to do, which is the essence of authorization. This practice enforces the principle of least privilege to mitigate risks like insider attacks.

A. Authentication: This is the process of verifying a user's identity (e.g., with a password or biometric scan), not determining their access rights.

B. Accounting: This refers to the tracking and logging of user activities for auditing purposes, which occurs after access has been granted and used.

C. Availability: This is a goal of security (part of the CIA triad) that ensures systems and data are accessible to authorized users, not the process of granting permissions.

---

1. National Institute of Standards and Technology (NIST). (2006). Assessment of Access Control Systems. NISTIR 7316.

Page 10

Section 2.2.2: Defines Authorization as "The process of determining

by evaluating applicable access control information

whether a subject is allowed to have the specified types of access to a particular resource... The authorization process occurs after the authentication process." This directly supports that assigning permissions is an act of authorization.

2. National Institute of Standards and Technology (NIST). (2020). Security and Privacy Controls for Information Systems and Organizations. NIST Special Publication 800-53

Revision 5.

Page 101

Section AC-2 (Account Management): This control family discusses assigning access rights (privileges) based on roles and the principle of least privilege

which are fundamental to authorization. The document states

"The organization: a. Defines and documents the rights and privileges of each assigned account role."

3. Saltzer

J. H.

& Schroeder

M. D. (1975). The Protection of Information in Computer Systems. Proceedings of the IEEE

63(9)

1278–1308.

Section I.A.3

Page 1281: This foundational academic paper distinguishes between authentication and authorization. It explains that after authentication confirms a user's identity

the system must have a way to "authorize access

" which involves consulting a list of authorizations (permissions) for that user. This establishes the academic basis for the distinction. (DOI: https://doi.org/10.1109/PROC.1975.9939)

4. Massachusetts Institute of Technology (MIT) OpenCourseWare. (2019). 6.858 Computer Systems Security

Fall 2014.

Lecture 2: Control Hijacking

Slide 5: The lecture slides clearly define the security model components: "Authentication: who is the user? Authorization: is user X allowed to do operation Y? (access control)." This university source explicitly equates authorization with access control and the act of determining allowed operations.