Networking Quiz

nc -zv only checks that something is listening on the port and will accept a TCP connection, it says nothing about what LANGUAGE that something speaks. If the service is actually plain HTTP but curl tries to speak encrypted TLS to it, the service has no idea what curl just sent, and the connection gets abruptly killed, which is exactly what SSL_ERROR_SYSCALL means here.

DNS rules require that when a name has a CNAME record, that record must be the ONLY record for that name, no other record type is allowed alongside it. The zone apex always needs NS and SOA records to function at all, so a CNAME can never legally live there. This is exactly why providers offer proprietary workarounds like ALIAS or ANAME records, which behave like a CNAME to configure but get resolved server-side into a plain A record at the apex.

GRE wraps your original packet inside its own extra header, which adds a bit of size on top of what was already there. Small pings never get big enough to hit the ceiling, but larger real traffic can end up exceeding the physical link's maximum packet size once GRE's overhead is added, causing fragmentation issues, adjusting the tunnel's MTU or clamping the TCP segment size is the standard fix.

A normal (access) port can only carry traffic for one single VLAN at a time. When a link between two switches needs to carry several VLANs' worth of traffic at once, it needs to be a trunk port instead, which tags each frame with an 802.1Q VLAN ID so the receiving switch knows which VLAN each frame actually belongs to.

SNI lets the client announce which hostname it's trying to reach as part of the TLS handshake itself, before the server has to pick and send a certificate, which is exactly what allows one IP and port to correctly serve multiple certificates for multiple domains. Without SNI support (or an old client that never sends it), the server has to guess and falls back to a single default certificate, causing a mismatch for anyone requesting the other domain. Assigning a separate IP per domain is the older workaround from before SNI existed, and a wildcard certificate only helps if both domains happen to share the same base domain.

These four networks (.0 through .3 in the third octet) are contiguous, meaning they sit right next to each other in a clean block. 'Borrowing back' 2 bits from the mask (going from /24 to /22) creates one wider range that exactly covers all four smaller subnets at once, letting you advertise them as a single route instead of four separate ones.

SSL 3.0, TLS 1.0, and TLS 1.1 all have real, well-known cryptographic weaknesses that attacks like POODLE and BEAST exploit. Because of that, OpenSSL 3.0 turns all three off by default, and you'd have to explicitly opt back in to use any of these older, weaker protocol versions.

EIGRP's DUAL algorithm won't just accept any alternate path as a usable backup, it specifically requires that path's reported distance to be strictly better than the current best path's own feasible distance. That rule is what guarantees backups are always loop-free, but it also means a redundant physical path can exist and still not qualify as a usable backup route.

When two switches have the exact same priority, STP has no other choice but to fall back to comparing their MAC addresses, and that's essentially outside your control since you can't reliably predict or choose a MAC address. Explicitly setting a lower priority on Switch A removes that guesswork entirely and guarantees it wins the root bridge election every time.

If you want to see every route a Cisco router currently knows about, whether it learned it from being directly connected, a static entry, or a dynamic routing protocol, along with exactly how it would reach each one, show ip route is the command built exactly for that.