Sample questions
Nc Topology Nat RelayDifficulty 1
RFC 4787 splits NAT UDP behavior into two separate axes. What are they?
- aPort allocation and checksum validation
- bAddress/port mapping and filtering✓
- cFragmentation and reassembly
- dEncryption and authentication
Explanation:RFC 4787 Section 4 defines address/port mapping behavior and Section 5 defines filtering behavior as two independent properties of a NAT; a device's mapping choice does not determine its filtering choice.
Nc Topology Nat RelayDifficulty 2
A NAT has 'Endpoint-Independent Mapping' behavior. What does this mean for an internal host sending packets to two different external destinations?
- aEach destination gets a mapping that expires after a single packet
- bThe internal host is assigned a new internal port for every destination
- cThe same external mapping is reused for both destinations✓
- dOnly the first destination receives a valid external mapping
Explanation:RFC 4787 defines Endpoint-Independent Mapping as reusing the same external IP:port mapping for packets sent from the same internal IP:port to any external destination.
Nc Topology Nat RelayDifficulty 2
Under 'Address and Port-Dependent Mapping', when does a NAT create a brand new external mapping for an already-mapped internal socket?
- aWhen a packet is sent to a new external IP address or port✓
- bOnly when the internal application restarts
- cOnly when the mapping's timer expires, regardless of destination
- dNever; one internal socket always keeps a single mapping
Explanation:RFC 4787 states that under Address and Port-Dependent Mapping, X1':x1' equals X2':x2' only if Y2:y2 equals Y1:y1 — any change in destination IP or port produces a different external mapping.
Nc Topology Nat RelayDifficulty 2
A NAT has 'Endpoint-Independent Filtering'. After the internal host sends one outbound packet to any external address, what inbound traffic is allowed back?
- aOnly replies from the exact external IP and port that were originally contacted
- bNo inbound traffic at all until a second outbound packet is sent
- cOnly replies from the exact IP that was contacted, from any port
- dPackets from any external IP and port that target the mapped internal address✓
Explanation:RFC 4787 describes Endpoint-Independent Filtering as forwarding any packet destined to the internal mapping, regardless of the external source IP or port, once any outbound packet has opened the mapping.
Nc Topology Nat RelayDifficulty 1
According to RFC 4787's REQ-5, what is the minimum allowed lifetime for a NAT's UDP mapping timer (outside a specific well-known-port exception)?
- a30 seconds
- bTwo minutes✓
- c10 minutes
- dThere is no minimum
Explanation:REQ-5 states a NAT UDP mapping timer MUST NOT expire in less than two minutes, with a default of five minutes or more recommended.
Nc Topology Nat RelayDifficulty 2
RFC 4787's REQ-6 requires a NAT mapping's 'Outbound refresh behavior' to be true. In practice, what must a P2P client keep doing to prevent its NAT mapping from expiring during an idle connection?
- aNothing; inbound traffic alone refreshes the mapping
- bClose and re-open the socket every few seconds
- cSend periodic outbound packets on it✓
- dAsk the NAT vendor to whitelist its port
Explanation:Since REQ-6 requires outbound refresh behavior, only packets going from the internal side to the external side reset the mapping timer, so a client must keep sending periodic outbound packets (keepalives) to hold the mapping open.