Q: Parsing Layer and Header Terminology

 In 200-301 V1 Ch01: Intro to TCP/IP, CCENT-OLD, Q&A

One big challenge for #CCENT and #CCNA test takers is interpreting tons of new terminology. Today’s post poses a question about headers and encapsulation, with plenty of terms. You job is simple: interpret the scenario, the terms, and answer the question. As usual, feel free to post questions about this question. Is it clear? If you saw this on the actual exam, what would be clear, and what wouldn’t be? I’ll post an answer and some explanation in a few days!

Also, as a courtesy, if you want to offer your answer, please do so, but don’t put it in the heading for your comment, to avoid spoiling it for others. The answers post (posted a few days after this post) will be linked at the bottom of this post. Thanks!


The Figure shows a small network with two user PCs (hosts A and B) on the left, and a web server (host C) on the right. The LAN switches each use only the default VLAN 1, with all ports in that VLAN. The user at PCs A and B can connect to the web server to display its home page. The hosts use the IP addresses and subnets as shown in the figure.

Note that host A uses router B1 as its default gateway, and host B uses router B2 as its default gateway.



Amy and Bob use the free Wireshark network analyzer software on host A to examine the data host A sends and receives. They examine the Ethernet header of a frame, and then argue about terminology that accurately refers to this header and the data encapsulated between this header and the Ethernet trailer. Which of the following are true?

A. The header is a Data Link layer header
B. The header is a Physical layer header
C. The header is one header in a layer 3 PDU
D. The header is part of TCP/IP Network Access layer
E. The header is the only header in a layer 2 PDU

Answers to a Root Question with No Direct Link to the Root
A: Parsing Layer and Header Terminology
Notify of

Newest Most Voted
Inline Feedbacks
View all comments
Matthew Simpson

A is the correct answer as the header is a Data Link layer header. Being Ethernet, it’s not a Physical layer header since physical layer is only 1s and 0s(correct me if I’m wrong, as I’m just getting back into studying Cisco for cert), so B is incorrect. It can’t be a layer 3 header, since the data in the Ethernet frame includes the layer 3 header, so C is incorrect as well. Virtually the same thing for D, as the TCP/IP network layer is the same as OSI layer 3, and a step above Ethernet. E is the tricky one, since due to the wording, it can be correct or incorrect. With this working of the question and answer though, I will say E is correct as well, since the Ethernet header is the only header in a layer 2 PDU as any other headers are encapulated as the data part of the PDU.


Hi Matthew,
Nice breakdown. I’ll post my equivalent in the next few days.

On your comments about answer E… indeed, the wording is always a challenge – but the better you master the terms as well as the concepts, the easier it is to make those intelligent guesses. Stayed tuned for the official answer! Thanks for playing.


I would also think A is the correct answer, regarding E not sure either since Wendell actually mentioned on the previous example:

“The Ethernet header, part of a Layer 2 PDU, is not part of any Layer 3 PDU. However, the Ethernet header in a layer 2 PDU is not the only header in the layer 2 PDU.” so that sort of makes me doubt about E.

cant wait to know whats on with E.

thanks all.


Hi Edu,
Thanks for the post. I’ll not answer directly here, and just point you at the link at the bottom of the page, which moves on to the answer post, and explains why each answer is right or wrong. If that doesn’t connect the dots for you, let me know!


Hi Wendell,

I can’t find the answer. Please help me. Thank you.


Hi Eslam,
The answer to each question post is linked at the bottom of the post automatically (and likewise, the question post is linked at the bottom of the answer post). It’s at the end of the post, just above the comment area.

In this case, look just below the answers A, B, C, D, E, and you’ll see the link.

Sijin Alexander

I cant find the answer. Please help


Hello – Try it now, I have adjusted the links so the Answer Post is now linked at the bottom on the Question Post

Erick Gomez

Mr: Wendell …My sincerely RESPECT .. but you’re correct … 100% and thanks for the challenge.. I just want to tell you that I would like to meet you one day .. you’re my HERO in this business.

OK: Matthew Simpson…

we don’t need to fight .. check this out .
Physical layer 1 : Ethernet …

IEEE 802.3 ,IEEE 802.11, IEEE 802.15 ,IEEE 802.16

“Ethernet provides services up to and including the data link layer.”

answer : D. The header is part of TCP/IP Network Access layer …

they are 3 .. the OSI, THE OLD TCP/IP AND THE NEW one .. all of them are reference ..and all 3 match and do the same .. logically

because they match .. physical and Data link : is the same than network access “OLD TCP/IP” .. I mean the logical says network access is layer 1 and layer 2 both together .. but Ethernet is a layer 1 belong to “LAYER 1” that provides services up to and including the data link layer.

NOTE : Ethernet is a collection of specifications for layers 1 (PHY) and 2 (DLL).

If you can’t explain it simply, you don’t understand it well enough. -Albert Einstein

thanks .. Wendell you’re the best …


Wow Erick. Nice post. And thanks for the compliments! If you’re ever at Cisco Live in the US, ping me and we can meet!


Hi Mr. Wendell, nice work.
I agree on A,E as correct answers.

The TCP/IP model only is a simplified form of the ISO/OSI model. This states that the layers are absolutely seperated from each other meaning “they don’t know anything about the other layers.
L2 is a bit difficult in ISO/OSI while it is splitted into a MAC and a Data Link layer. This is due to the IBM mainframe network architecture in the early 80’s – and also NetBIOS – when ISO/OSI was agreed on.

Looking at one special layer, lower layer information is cut already while upper layer information is data at all – there are also odd things like brouters working on L2,3.

So, looking at an Ethernet L2 PDU

A. correct. of course it is.
B. is incorrect because it is L1 and is not accessible at L2
C. is incorrect because L2 doesn’t understand L3 (header, trailer, data???)
D. is incorrect because L2 doesn’t understand L4 and it’s specialities. Furthermore there is no “TCP/IP Access Network Layer” – either Network or Transport Layer, nothing else.
E. is correct because of course a L2 PDU, like any other PDU, has one and only one header. Additionally there exists a trailer here.

The above example is much more interesting at L3 due to multiple IP routes to the same destination. Fortunately, these are routers not bridges 😉

Thanx for the great work in your books and your site.


The best aspect of your practice test Q&As are that the setups and the wording of your test questions are as dense and obfuscatory as I expect the official Cisco test to be. They will trip you up unless you know the stuff backwards and forwards, and your material is presented on that level. I really appreciate that.


I’m a little late to the discussion. I originally picked ‘A’ only. However, based on a little note in chapter 1 it does refer to the old/original TCP/IP stack/model and its link layer also referred to as the network access and network interface. Geez. Talk about Cisco speak. When a question is asked about the models/stacks and doesn’t specify which one in particular which one is it safe to assume? OSI, old TCP/IP, new TCP/IP?


Yeah, if it weren’t so frustrating it’d be a little funny. But I hear you.

Short version to your literal question: you should know all of them, and be ready for them, and be ready to read an individual question and determine the answer from context. Honestly, I think if you do that for this particular topic, answering any real exam questions will be simple.

That said, any question about what to know or not know for the test edges towards NDA, so I cannot answer too directly. But I can answer to say that a “major on the majors, minor on the minors” strategy applies throughout. The exams can include anything. But, if you check most any forum (eg learningnetwork.cisco.com), you can probably tell which topics are the most important. And I’d say TCP/IP models are not even minor in that model.

Not a very satisfying answer, but it is the nature of the exam program.

Joshua Douglas

I can not find the answer.

Prathmesh Patil

Ans. A,D and E all are Correct.
Reffering to the Learnings in Chapter 1, The ethernet header is indeed the Layer 2 header. In terms of OSI terminology Layer 2(data link layer) is also called as Network Access layer. And Every frame has a unique header, so the header they(amy and bob) examining is the only header in Layer 2 PDU.

Chris Dedman-Rollet

I think like you, but the trick for D it’s the word “ONLY” …


Answers: A and D
Answer E is incorrect because in the layer 2 PDU it includes, in addition to the frame header, the network and transport header.

Would love your thoughts, please comment.x