01. A probe must be a UDP datagram addressed at the IP layer, carrying eight bytes of payload.
Which expression builds it?
a) IP(dst="192.0.2.5")/UDP(dport=53)/Raw(load=b"abcdefgh")
b) IP(dst="192.0.2.5") + UDP(dport=53) + Raw(load=b"abcdefgh")
c) IP(dst="192.0.2.5", UDP(dport=53), Raw(load=b"abcdefgh"))
d) Raw(load=b"abcdefgh")/UDP(dport=53)/IP(dst="192.0.2.5")
02. A script downloads a multi-gigabyte capture file with r = requests.get(url) and then reads r.content. On large files the process runs out of memory.
What is the problem, and what fixes it?
a) The library caps a plain download at a few megabytes, so a larger buffer-size argument is what lets the file through.
b) The decoded body is never released after it is read, so calling r.close() after r.content frees the memory and avoids the error.
c) The body is duplicated across r.content and r.text, so reading r.text alone, and not r.content, removes the memory pressure.
d) Reading r.content loads the whole body into memory at once, so the response should be requested with stream=True and written in chunks with r.iter_content.
03. A client gets 404 back from one endpoint and 503 from another.
What do those two status classes tell it about where the fault lies?
a) Both report a transport failure, so neither response carries a body worth reading or acting on.
b) The first says the request itself was at fault. The second says the server could not fulfill a request it accepted.
c) The first means the server is unavailable and the second means the client is not authenticated for the resource.
d) The first marks a redirect the client should follow, and the second marks a request the server declines to accept at all.
04. An analyst has narrowed a capture down to the packets of interest, held in a list named keep, and wants them in a pcap file another tool can open.
Which call writes them?
a) sniff("keep.pcap", keep)
b) sendp(keep, "keep.pcap")
c) wrpcap("keep.pcap", keep)
d) rdpcap("keep.pcap", keep)
05. A service must receive UDP datagrams on port 9000 and answer whoever sent each one.
Which sequence of socket calls does the server make?
a) socket(), connect(), then recv() and send() for each datagram
b) socket(), bind(), listen(), accept(), then recvfrom() for each datagram
c) socket(), listen(), bind(), then recvfrom() and sendto() for each datagram
d) socket(), bind(), then recvfrom() and sendto() for each datagram
06. A monitoring agent streams JSON records over one long-lived TCP connection. The collector reads with recv(4096) and passes each result straight to json.loads. Records are small and most arrive intact, but the collector intermittently fails on input that is cut short or on two records run together.
Which change to the protocol addresses the cause?
a) Move the agent to UDP, since a datagram socket delivers each record as one unit, exactly once and in order.
b) Raise the collector's read size, so a whole record always fits inside a single call.
c) Frame each record, by prefixing its byte length or ending it with a delimiter the payload cannot contain, and read until exactly one whole record is in hand.
d) Have the agent pause briefly between records, so each one lands on its own and consecutive writes are not combined.
07. A single-threaded TCP server has created, bound and readied its listening socket, and reaches this line with no client yet connected:
conn, addr = server.accept()
What does the program do here?
a) It returns the listening socket itself, which the server then reuses for the traffic of every client that arrives.
b) It stops at this line until a client connects, and runs nothing else in the meantime.
c) It returns straight away with both names bound to None, so the server has to test them and call again.
d) It raises an exception, because a connection has to be waiting already.
08. A protocol says the next message is exactly sixty bytes long. The reader must return all sixty and leave anything after them for the next read.
Which loop does that?
a) buf = b"" while len(buf) < 60: chunk = sock.recv(60 - len(buf)) if chunk == b"": raise ConnectionError("closed early") buf += chunk
b) buf = sock.recv(60) while len(buf) < 60: chunk = sock.recv(60 - len(buf)) if chunk == b"": break buf = chunk
c) buf = b"" while len(buf) < 60: chunk = sock.recv(60) buf += chunk if len(buf) > 60: buf = buf[:60]
d) buf = b"" while True: chunk = sock.recv(60) buf += chunk if chunk == b"": break
09. A client pushes a large buffer onto an established TCP connection:
payload = b"x" * 40000 n = sock.send(payload)
The code that follows assumes the whole buffer has been handed to the transport. Which change makes that assumption sound?
a) Follow the call with sock.send(payload[n:]), since at most one short write can happen per buffer.
b) Repeat sock.send(payload) in a loop until the call returns a value other than zero.
c) Compare n with len(payload) and, where they differ, send the whole buffer again.
d) Call sock.sendall(payload), which keeps writing until every byte has been accepted or it raises.
10. A client bounds how long it will wait for a reply:
sock.settimeout(5.0) try: data = sock.recv(1024) except OSError: data = None
Five seconds pass and the peer, still connected, has sent nothing. What happens?
a) The socket is closed automatically at the deadline and the read returns whatever partial data had accumulated in the buffer.
b) The waiting read is abandoned and a timeout exception raised, so the handler runs and data becomes None.
c) The bound applies only to establishing the connection, so this read waits until data arrives or the peer closes.
d) The read gives up and returns b"", so data holds empty bytes and the handler is never entered.