Network fundamentals, devices, protocols and the TCP/IP model – IB Computer Science exam questions with mark scheme

1Core4 marks

Distinguish between the function of a router and a switch in a network. [4]

A switch connects devices within the same network/LAN(1)
It uses MAC addresses to forward frames only to the intended device (allow: rather than broadcasting to all devices like a hub; network interface/link layer)(1)
A router connects different networks together (e.g. a LAN to the internet / a WAN)(1)
It uses IP addresses to forward packets along the best route to the destination network (allow: internet layer)(1)
Answer: Switch: MAC-based forwarding within a LAN. Router: IP-based routing between networks.
Examiner tip: Pair each device with its address type (MAC vs IP) and scope (within vs between networks).

2Core4 marks

Identify the type of network (LAN, WAN, PAN or VPN) that best describes each of the following.

(a) A pair of wireless earbuds and a smartwatch connected to one person's smartphone. [1]

(b) The network linking the computers, printers and servers inside a single secondary-school building. [1]

(d) A nurse working from home who connects over the public internet to the hospital's internal records system through an encrypted tunnel, so her laptop behaves as if it were on the hospital network. [1]

(a) PAN (personal area network) (accept Bluetooth PAN)(1)
(b) LAN (local area network) (accept WLAN)(1)
(c) WAN (wide area network)(1)
(d) VPN (virtual private network) (do not accept WAN alone)(1)
Answer: (a) PAN (b) LAN (c) WAN (d) VPN
Examiner tip: The deciding feature is the geographical range, except for a VPN, which is defined by the secure tunnel over a public network, not by its size.

3Standard6 marks

The diagram shows the network of a small accountancy office.

(a) Outline the function of the modem. [1]

(b) Outline the function of the wireless access point (WAP). [1]

(d) State the layer of the TCP/IP model at which (i) the switch and (ii) the router mainly operate. [2]

(e) Explain why the hardware firewall is placed between the router and the modem. [1]

(a) Converts (modulates/demodulates) between the digital signals of the office network and the signal used on the ISP's line (e.g. telephone/cable/fibre) (accept: connects the network to the ISP by converting signals; do not accept 'connects to the internet' alone)(1)
(b) Lets wireless devices (e.g. the laptop) connect to the wired network, by sending and receiving radio (Wi-Fi) signals and passing the data to/from the switch/router(1)
(c) Provides the physical connection/interface between the computer and the network medium, with a unique MAC address so the device can send and receive frames (accept either the connection or the MAC-address point)(1)
(d)(i) Switch: network interface layer (accept link layer / data link layer)(1)
(d)(ii) Router: internet layer (accept network layer; do not accept transport layer)(1)
(e) All traffic between the office network and the internet must pass through this point, so the firewall can inspect/filter every packet entering or leaving before it reaches the internal devices (accept: it sits at the boundary between the trusted LAN and untrusted internet)(1)
Answer: (a) Converts signals between the LAN and the ISP line. (b) Connects wireless devices to the wired network. (c) Physical network connection with a MAC address. (d) Switch: network interface; router: internet. (e) Single choke point between LAN and internet, so all traffic is filtered.
Examiner tip: 'Connects to the internet' is too vague for a modem; you must say it converts signals for the ISP's line.

Stuck on Network fundamentals, devices, protocols and the TCP/IP model?

Get it sorted in a free 30-minute session

We work through your weakest questions on this topic on Zoom. I reply the same day.

Free 30-min session on this topic Send me 5 questions a day

4Standard4 marks

An online racing game sends each player's car position to the game server 30 times per second. When a new version of the game is released, players download a 2 GB update file.

(a) Explain why UDP is used to send the car positions. [2]

(b) Explain why TCP is used to download the update file. [2]

(a) UDP is connectionless / has no handshake, acknowledgements or retransmission, so it has lower overhead and latency (accept: faster);(1)
a lost position update does not matter because a newer one arrives about 33 ms later, and resending an old position would be useless/cause lag (accept: real-time data where speed matters more than reliability)(1)
(b) TCP guarantees reliable, in-order delivery: lost or corrupted segments are detected (acknowledgements/checksums) and retransmitted, and segments are reordered using sequence numbers;(1)
every byte of the update file must arrive correctly or the program will be corrupted/not install, and the download is not time-critical so the extra delay is acceptable(1)
Answer: (a) Low latency/overhead; old positions are worthless so loss is acceptable. (b) Reliable, ordered delivery needed because one missing byte corrupts the file; a short delay does not matter.
Examiner tip: Each answer needs both a property of the protocol and a reason linked to this data; a generic 'UDP is faster' scores only one mark.

5Standard6 marks

A student's new phone joins the school Wi-Fi network. It does not yet have an IP address. The school network uses DHCP.

(a) Outline the purpose of DHCP. [1]

(b) Describe how the phone obtains an IP address from the DHCP server. [3]

(d) State the transport-layer protocol that DHCP messages are carried by. [1]

(a) Automatically assigns/leases IP addresses (and network settings) to devices when they join the network, so they do not have to be configured manually and addresses are not duplicated(1)
(b) The phone broadcasts a request to the whole network looking for a DHCP server (DHCP Discover), because it does not know the server's address;(1)
the DHCP server replies offering an available IP address from its pool (DHCP Offer);(1)
the phone requests/accepts that address and the server confirms/acknowledges it, leasing it to the phone for a set time (DHCP Request and Acknowledge) (accept the DORA names or equivalent descriptions; award max 2 if steps are out of order)(1)
(c) Any one: subnet mask; default gateway (router) address; DNS server address; lease time(1)
(d) UDP (do not accept TCP)(1)
Answer: (a) Automatic assignment of IP addresses and settings. (b) Discover (broadcast) - Offer - Request - Acknowledge, address leased for a time. (c) e.g. default gateway / subnet mask / DNS server. (d) UDP.
Examiner tip: Students often forget that the first message must be a broadcast: the phone has no IP address and does not know where the server is.

6Standard5 marks

A pupil logs in to a revision website from a café's public Wi-Fi. An attacker on the same Wi-Fi captures the following request sent by the pupil's browser:

POST /login HTTP/1.1
Host: www.revise-online.example
Content-Type: application/x-www-form-urlencoded

username=amira.k&password=Tulip42!

(a) Identify two pieces of information the attacker can read from this request. [2]

(b) The website changes to HTTPS. Explain how this protects the pupil's login. [2]

(a) Any two: the password (Tulip42!); the username (amira.k); the website/host name or page being visited (www.revise-online.example, /login) - 1 mark each(1)
(second item from the list above)(1)
(b) HTTPS sends HTTP over TLS (accept SSL), which encrypts the data between the browser and the server, so a captured request would be unreadable to the attacker;(1)
the server's digital certificate lets the browser verify it is talking to the genuine website, preventing an attacker impersonating it (man-in-the-middle) (accept: integrity checks detect tampering)(1)
(c) 443(1)
Answer: (a) e.g. password Tulip42! and username amira.k. (b) TLS encryption makes captured data unreadable; certificate authenticates the server. (c) 443.
Examiner tip: 'HTTPS is secure' earns nothing: say what it does (encrypts with TLS, authenticates the server with a certificate).

7Hard6 marks

A city installs 2,000 smart cameras at road junctions. Each camera detects traffic queues and the traffic lights must change within 0.2 seconds of a queue forming. Summary statistics (vehicle counts per hour) are kept for a year so planners can study traffic patterns. Cameras at some outer junctions connect only through the 4G/5G mobile network.

(a) Explain why edge computing is more suitable than sending all the video to a cloud data centre for deciding when to change the lights. [3]

(b) Describe one benefit and one limitation of storing the summary statistics in the cloud. [2]

(a) Processing is done on/near the camera, so there is no round trip to a distant data centre, giving low latency so the 0.2 s deadline can be met;(1)
only small results/summaries are sent rather than continuous video from 2,000 cameras, greatly reducing the bandwidth needed (and data costs);(1)
the lights keep working if the internet/cloud connection fails or is congested (accept: improved privacy as raw video need not leave the junction)(1)
(b) Benefit, any one: scalable storage as data grows; accessible to planners from anywhere; provider handles backups/maintenance; no need to buy servers (pay as you go)(1)
Limitation, any one: depends on an internet connection to access; ongoing subscription costs; data held by a third party raises security/privacy or data-location concerns; outages at the provider(1)
(c) Any one: patchy coverage/weak signal in some areas; bandwidth/latency varies with congestion (e.g. at busy times); data charges; lower reliability than a fixed line(1)
Answer: (a) Local processing gives low latency, saves bandwidth, works if the link fails. (b) e.g. scalable/accessible vs dependent on connection/third party. (c) e.g. coverage or congestion makes the link unreliable.
Examiner tip: For edge computing, tie latency to the stated 0.2 s deadline; vague 'it is faster' answers lose the application mark.

8Hard5 marks

The diagram shows TCP segments sent from a sender to a receiver. Each segment carries 500 bytes and is labelled with its sequence number (the number of its first byte). The segment with sequence number 2000 is lost. Each acknowledgement (ACK) number is the sequence number of the next byte the receiver expects.

(a) State the value of acknowledgement number P, sent after the segment with Seq = 1500 arrives. [1]

(b) State the value of acknowledgement number Q, sent after the segment with Seq = 2500 arrives. [1]

(d) State the acknowledgement number the receiver sends after the resent segment arrives. [1]

(a) P = 2000(1)
(b) Q = 2000 (accept: a duplicate ACK of 2000, because bytes 2000-2499 are still missing)(1)
(c) The sender does not receive an acknowledgement covering the missing bytes before its timer expires (accept: receives repeated/duplicate ACKs for 2000);(1)
so it retransmits the segment with Seq = 2000; the receiver buffers the out-of-order segment 2500 and uses the sequence numbers to put the data back in the correct order(1)
(d) 3000(1)
Answer: (a) 2000 (b) 2000 (c) Timeout / duplicate ACKs -> retransmit Seq 2000; receiver reorders by sequence number. (d) 3000
Examiner tip: Q is not 3000: TCP ACKs are cumulative, so the receiver keeps asking for the first missing byte until it arrives.

9HardHL only6 marks

A web server sends a response of 4,000 bytes (HTTP header and page data together) to a browser. At the transport layer, TCP splits the data into segments carrying at most 1,460 bytes of data each. Each layer then adds the following:

TCP header: 20 bytes per segment
IP header: 20 bytes per packet
Ethernet header and trailer: 18 bytes per frame

(a) Calculate the number of TCP segments needed. [1]

(b) Calculate the total number of bytes transmitted at the network interface layer. [2]

(c) Calculate the percentage of the transmitted bytes that are the TCP, IP and Ethernet headers and trailers. Give your answer to 3 significant figures. [1]

(d) Describe how the layers of the TCP/IP model interact when the server sends this response. [2]

(a) 4000 / 1460 = 2.74, so 3 segments (1460, 1460, 1080 bytes)(1)
(b) overhead per frame = 20 + 20 + 18 = 58 bytes, so 3 × 58 = 174 bytes of headers/trailers (method mark; allow ECF from (a))(1)
total = 4000 + 174 = 4174 bytes(1)
(c) 174 / 4174 × 100 = 4.17% (allow ECF from (b))(1)
(d) Each layer passes data down to the layer below, which adds its own header (and trailer at the network interface layer) to it: encapsulation (application data → TCP segment → IP packet → frame);(1)
each layer only uses the services of the layer directly below and its header is read only by the same (peer) layer at the receiver, which strips it and passes the rest up (accept: transport adds ports/sequence numbers, internet adds IP addresses, network interface adds MAC addresses)(1)
Answer: (a) 3 (b) 4174 bytes (c) 4.17% (d) Encapsulation: each layer adds its header and passes down; the peer layer at the receiver removes it.
Examiner tip: The 1,080-byte final segment still needs a full set of headers, so multiply the overhead by 3, not by 4000/1460.

10StretchHL only6 marks

An engineer staying in a hotel uses a VPN to reach a file server on her company's private network. The diagram shows one packet as it leaves the hotel's network for the internet. The file server's address is 10.20.0.15.

(a) Explain why routers on the internet forward this packet using the outer IP header and not the inner one. [2]

(b) Identify one piece of information that another guest capturing traffic on the hotel Wi-Fi can still learn about this communication. [1]

(c) With reference to the layers of the TCP/IP model, explain how the packet's data reaches the file server application after it arrives at the company's VPN gateway. [3]

(a) The inner header (and everything after it) is encrypted, so internet routers cannot read the inner destination address;(1)
10.20.0.15 is a private address that is not routable on the public internet, so routers deliver the packet to the VPN gateway's public address 203.0.113.10 in the outer header(1)
(b) Any one: that the hotel/her device is communicating with 203.0.113.10 / the company's VPN gateway; the amount/size of data and the timing of the traffic; that a VPN is in use (do not accept the file contents or the file server address)(1)
(c) The gateway's network interface and internet layers receive the packet addressed to it; it removes the outer IP header and decrypts the payload, recovering the original (inner) IP packet;(1)
the gateway acts as a router at the internet layer, forwarding the inner packet across the company LAN using its destination address 10.20.0.15 (in a new frame with the server's MAC address);(1)
at the file server each layer removes its own header and passes the data up: the internet layer checks the IP address, the transport layer (TCP) uses the port number to deliver the data, in order, to the file server application, which is unaware the VPN was used(1)
Answer: (a) Inner header encrypted and 10.20.0.15 is private/non-routable; routing uses public 203.0.113.10. (b) e.g. that she is talking to the company VPN gateway, and how much data. (c) Gateway strips outer header and decrypts, forwards inner packet by its IP address on the LAN; server de-encapsulates up to TCP, which delivers by port to the application.
Examiner tip: A VPN hides the contents, not the fact of the connection: the outer header showing the VPN gateway's public address is still visible.

Stuck on this topic?

Book a free 30-minute session on WhatsApp and we'll find exactly which step is costing you the marks. Or build a timed paper on it.

Free 30-minute session