Network Security Interview Question

When applying for a Network Security position, it makes sense to prepare by familiarizing yourself with a set of appropriate network security questions. Having a good grasp of often-asked network security questions enables you to present yourself as an adept candidate with an in-depth understanding of the subject. In an effort to inform and prepare you for that important network security interview, here are some of the top network security interview questions and answers. There’s no guarantee that you will be asked ALL of these network security interview questions, or that other network security questions not included here won’t be asked. Still, be assured that the following are more likely than not to be asked.
Bear in mind, however, that while having a question guide like the one below is a smart thing to have at your disposal, nothing can replace gaining important network security skills. This is especially true today, since the demand for network security professionals continues to rise. For more details on that, check out the useful information at the end of the Q&A.
Note that some of the answers are actually descriptions of the kind of replies an interviewer will be expecting, since the exact answer may vary from one applicant to another. Now let’s get to those network security questions and answers!
Q: What do you see as the objective of information security within a business or organization?
A: Network security should:

• Ensure uninterrupted network availability to all users
  
• Prevent unauthorized network access
  
• Preserve the privacy of all users
  
• Defend the networks from malware, hackers, and DDoS attacks
  
• Protect and secure all data from corruption and theft
  Q: How do you define risk, vulnerability, and threat, in the context of network security?
  A: A risk is defined as the result of a system being secure but not secured sufficiently, thereby increasing the likelihood of a threat. A vulnerability is a weakness or breach in your network or equipment (e.g. modems, routers, access points). A threat is the actual means of causing an incident; for instance, a virus attack is deemed a threat.
  Q: What are the possible results of an attack on a computer network?
  A: Possible results include:
  

• Loss or corruption of sensitive data that is essential for a company’s
  survival and success
  
• Diminished reputation and trust among customers
  
• The decline in value with shareholders
  
• Reduced brand value
  
• Reduction in profits
  Q: What do you use on your own personal network?
  

A: An interviewer will want to know what sort of security measures you use on your own home devices. After all, if you’re a hotshot network security expert, clearly that must be reflected in the network that means the most to you; your personal system! An employer can tell a lot about your network savyiness by analyzing what measures you use for your devices.
Q: Speaking of your home network, do you have a Wireless Access Point, and if so, how do you defend it?
A: There are many methods of protecting a WAP, but the three most popular are: employing MAC address filtering, using WPA2, and not broadcasting the SSID. This is yet another attempt by an employer to see what matters to you personally in terms of security. After all, people tend to prefer the best things for themselves!
Q: How informed do you keep yourself on network security-related news, and how often do you check out these stories? Where do you get your security news from?
A: Network security incidents are big news today, and there have been many high-profile news stories about data breaches and hackers in the past few years. An employer is going to want to know how well-informed you are on the latest security news and incidents. HINT: If you don’t make it a practice of keeping abreast of the latest network security-related news, you better start now!
In terms of news sources, your best bets are Team Cymru, Twitter, or Reddit. Make sure to check the sources of accuracy, though.
Q: What're the best defenses against a brute force login attack?
A: There are three major measures you can take to defend against a brute force login attack. For starters, there’s an account lockout. Offending accounts are locked out until such time as the administrator decides to open it again. Next comes the progressive delay defense. Here, the account stays locked for a given number of days after a few unsuccessful login attempts are made. Finally, there’s the challenge-response test, which heads off automatic submissions employed on the login page.
Q: Explain the difference between symmetric and asymmetric encryption.
A: Long story short, symmetric encryption uses the same key for both encryption and decryption, whereas asymmetric encryption employs different keys for the two processes. Symmetric is faster for obvious reasons but requires sending the key through an unencrypted channel, which is a risk.
Q: Explain the difference between a white and black hat hacker.
A: Black and white hat hackers are different sides of the same coin. Both groups are skilled and talented in gaining entry into networks and accessing otherwise protected data. However, black hats are motivated by political agendas, personal greed, or malice, whereas white hats strive to foil the former. Many white hats also conduct tests and practice runs on network systems, to ascertain the effectiveness of security.
Q: Define the salting process and what it’s used for.

A: Salting is the process wherein you add special characters to a password in order to make it stronger. This increases password strength in two ways: it makes it longer and it adds another set of characters that a hacker would have to guess from. It’s a good measure to take for users who tend to habitually make weak passwords, but overall it’s a low-level defense since many experienced hackers are already familiar with the process and take it into account.
Q: How do you deal with “Man In the Middle” attacks?
A: A Man in the Middle attack happens when there is a third party that’s monitoring and controlling a conversation between two parties, with the latter completely unaware of the situation. There are two ways of dealing with this attack. First of all, stay off of open Wi-Fi networks. Second, both parties should employ end-to-end encryption.
Q: Which is the better security measure, HTTPS or SSL?
A: HTTPS (Hypertext Transfer Protocol Secure) is HTTP combined with SSL, encrypting a user’s browsing activity and making it safer. SSL (Secure Sockets Layer) is a protocol which protects Internet conversations between two or more parties. Though it’s close, SSL wins out in terms of sheer security, though any of these are valuable things to know for the purposes of web development.
Q: Name the three means of user authentication.
A: There is biometrics (e.g. a thumbprint, iris scan), a token, or a password. There is also two-level authentication, which employs two of those methods.
Q: Which is a more secure project: open-source or proprietary?
A: This is a trick question; don’t be fooled! A project’s security is determined by the quality of security measures used to protect it, the number of users/developers with access, and the overall size of the project. The kind of project is irrelevant.
Q: If you work with a Linux server, what are the three significant steps you must take in order to secure it?
A: In order to secure your Linux server, you must do the following, in order:

• Audit. Scan the system using Lynis. Each category gets scanned separately, and a hardening index is generated for the next step.
  
• Hardening. Once auditing is done, hardening is done, based on the level of security to be employed.
  
• Compliance. This is an ongoing step, as the system is checked daily.
  Q: You discover an active problem on your organization’s network, but it’s out of your sphere of influence. There’s no doubt that you can fix it, though; so what do you do?
  A: While the first impulse may be to immediately fix the problem, you need to go through the proper channels. Things may be as they are for a reason. Use e-mail to notify the person in charge of that department, expressing your concerns, and asking for clarification. Make sure your boss is CC’ed into the email chain, and make sure that you save a copy for yourself, in case you need to refer to it later.
  

Q: What’s the most effective measure to take against a CSRF?
A: A Cross-Site Request Forgery (CSRF) attack causes a currently authenticated end user to execute unauthorized commands on a web application. There are two effective defensive measures. First of all, use different names for each field of a form, as it increases user anonymity. Second, include a random token with each request.
Q: You get a phone call from a very influential executive high up on the organizational chart. He or she tells you to bend company policy to suit them and let them use their home device to do company work. What do you do?
A: This is another case of letting someone higher than you make the decision. Send the question/request up to your manager and let them sort it out. This is far outside of your realm. Let your boss deal with the higher-up.
Q: Which is worse in terms of Firewall detection, and why? A false positive or a false negative?
A: A false negative is worse by far. A false positive is a simply a legitimate result that just got incorrectly flagged. While it’s irksome, it’s by no means fatal or difficult to correct. But a false negative means that something bad has slipped through the firewall undetected, and that means a host of problems down the road.
Q: Why are internal threats usually more effective than external threats?
A: It all comes down to a question of physical location. A disgruntled soon to be ex-employee, a hacker posing as a deliveryman, even just a careless curious user, all end up having better access to the system due to them being onsite. Being “inside” physically makes it easier to get inside virtually.

Edx Network Security: Packet Sniffing

IP packets, which exist at layer three of the OSI model are encapsulated inside of layer two frames. On wired lens, they are ethernet frames. On wireless lens, they are 802.11 frames. In the context of capturing and analyzing network traffic, even though the lowest unit to analyze is the frame, it's still called packet sniffing. Every single bit -- all the ones and zeros that go in and out of a NIC can be seen and analyzed. There's an option to see them in true binary. Even hexadecimal. But, as humans, we prefer a format that is more intuitive. A packet sniffer implemented in software or hardware will not only intercept and log all the ones and zeros moving in and out of a nic, but show it to us, humans, in a human-readable format. In addition to binary and hexadecimal. All of the fields of every single frame, packet, segment, data gram, and upper layer data will be shown with their names. Along with their corresponding data values. For example, in the IP packet, source IP address -- 192.168.1.113. Destination IP address -- 192.168.1.107. We will see the content as they're listed in the RFC, or other specifications.
Packet sniffers can provide so much insight to network traffic.
    They can monitor data in motion -- serve as primary data source for day-to-day network monitoring and management.
    Monitor network usage, including internal and external users and systems.
    Gather and report network statistics.
    Verify adds, moves, and changes.
    Verify internal control system effectiveness in firewalls, access control lists, web filters, spam filters, and proxies.
    Document regulatory compliance through logging all perimeter and end point traffic.
    Monitor WAN Bandwidth utilization.
    Monitor WAN and endpoint security status.
    Analyze network problems.
    Debug client server communications.
    Debug network protocol implementations.
    Gain information for carrying out a network intrusion.
    Spy on other network users by eavesdropping on unencrypted data.
    Collect sensitive information, such as login details or user cookies, depending upon encryption being used.
    And, capture packets for subsequent playback in replay, man-in-the-middle, and packet injection attacks.
    Reverse engineer proprietary protocols used over the network.
    Detect network intrusion attempts.
    Detect network misuse by internal and external users.
    Filter suspect content from network traffic.
While encryption doesn't stop packet sniffers from seeing header fields, including source and destination MAC addresses that layer two source and destination IP addresses at layer three, and source and destination ports at layer four, the payloader data portion that's encrypted appears as gibberish to the packet sniffer. This is where SSL TLS encrypted data, versus plain text HTTP, comes into play. Modifying or injecting data into the packets would cause errors that would be obvious when the decryption would be attempted at the other end.
A packet sniffer can only capture packet information within a given subnet or on a particular device's nic. An attacker can't place a packet sniffer on their network and capture network traffic from inside a corporate network. However, there are ways to hijack a system running on an internal network and make it packet sniff from a remote location. While there are a few dozen packet sniffers, some with specialized purposes, there is one that stands above the rest. From Wireshark's website. Wireshark is the world's foremost and widely used network protocol analyzer. It lets you see what's happening on your network at a microscopic level, and is the de facto, and also dejour standard, across many commercial and nonprofit enterprises, government agencies, and educational institutions. Wireshark development thrives, thanks to the volunteer contributions of networking experts around the globe, and is the continuation of a project started by Gerald Combs in 1998.

Network Security: Passwords and Human Error

A past IBM cyber security intelligence index report concluded that 95% of security breaches are caused by human error. Human error definitely includes password choices by users. It also includes password requirements and password storage by systems administrators. Passwords are a large part of network security. Hackers can use a technique called "password guessing" in which they manually enter passwords at a log-in prompt to gain access to an account when they have a valid user name. There are tools to automate this guessing process, known as an online attack, including Medusa, Ncrack, and Hydra.

These tools were built to help companies secure their networks as security specialists can test hosts and networking devices for poor passwords. These tools are used to audit devices as well. Online attacks can also be used to check that your firewalls, IDSs, and IPSs detect when a server gets bombarded with unsuccessful log-in attempts and that accounts lock in a short period when this happens. Password guessing through manual or automated means is obviously very noisy, so hackers need a better way to do it. Passwords should never be stored in plain text in databases. Storing passwords in plain text allows them to be used immediately after they're stolen. Passwords should be stored in a strong hash format since hashing is a one-way function. 

In many of the data breaches of recent years, stolen password databases contain passwords that were either stored in plain text or hashed with weak algorithms like MD5 or SHA-1. The current standards of hashing include SHA-256 and SHA-512, both forms of SHA-2.

On Linux systems, password hashes are stored in the etc/shadow file. Most Linux distros use SHA-512 with something called "SALT".

On Windows systems, password hashes are stored in the SAM file located at C:windows\system32\config\SAM. Some Microsoft documentation expands SAM to Security Account Manager while other Microsoft documentation expands SAM to Security Accounts Manager. On Windows domain controllers running Active Directory, password hashes are stored in the NTDS.dit file located at C:windows\NTDS\NTDS.dit. The Windows NTLM, Lan Manager Protocol Suite, actually uses MD4 without SALT for storing Windows hashes.

Websites that we log into store passwords in a backend database likely using the MySQL relational database management system. If a hacker enters the stolen hash into the password field, the hash itself would be hashed, so the attacker won't do that. What happens when a database containing hashed passwords are stolen? The hackers have three attack options after they steal the hashed password database. The first is called a "brute force attack" which uses a tool that generates a file containing all possibilities of letters, numbers, and symbols given a minimum and maximum length. The second is a dictionary attack which uses common words and their variations instead of trying all possibilities like a brute force attack does. The third is a rainbow table attack which requires more processing but less storage than a dictionary attack.

Network Security: Promiscuous Mode

When a frame enters a NIC, if the destination Mac address is not the NIC's Mac address, a broadcast or a multicast, the NIC with drop the frame. Promiscuous mode is a mode for a wired or wireless NIC which causes the NIC to pass all traffic it receives up the networking stack on a machine. Now, the NIC will accept and read frames that have unicast addresses other than the NIC's Mac address. Of course, on a switch network, promiscuous mode is not useful since the switch will only send frames to ports associated with destination Mac addresses as listed in the switches CAM, content addressable memory table, also known as SAT, source address table. The one exception is an unknown unicast when a switch doesn't know which port a destination Mac address is associated with. The switch will flood the frame out of all ports except the port on which the frame originated. Normally, this won't be a problem because every data exchange should be preceded by an ARP request and an ARP reply. Which makes the communicating stations known to the switch before any data is transferred. In a future unit, we'll explore an attack and mitigation for actually seeing unknown unicasts contain data after the ARPs. On wi-fi networks with encryption using WPA Two, by default, packets to or from other hosts will not be able to be decrypted by the NIC. And will not be captured. So, promiscuous mode works the same as non-promiscuous mode. On wi-fi networks without encryption, promiscuous mode works, as it does on wired networks. Allowing NICs to read traffic with unicast addresses other than the NIC's Mac address. Monitor mode also allows a device with a wireless NIC to monitor all traffic received from a wireless network. The big difference between promiscuous mode and monitor mode is that monitor mode allows packets to be captured without having to associate with a wireless access point first. Another difference is that monitor mode only applies to wireless networks while promiscuous mode can be used on both wired and wireless networks. Monitor mode is like listening to people's conversations as you walk across the RIT campus.

Promiscuous mode is like sitting down with a bunch of people at a table, at a restaurant. You can hear conversations between other people at the same table. Each client on a WPA Two, PSK infrastructure has their own handshake. So, by default, you won't be able to monitor any traffic except your own on an encrypted network. However, if you know the preshared key and capture their handshake, you can decrypt their whole session.

Network Security: Packet Sniffing - Limitation and Hacks

A packet sniffer can only capture packet information within a given subnet or on a particular device's nic. An attacker can't place a packet sniffer on their network and capture network traffic from inside a corporate network. However, there are ways to hijack a system running on an internal network and make it packet sniff from a remote location. While there are a few dozen packet sniffers, some with specialized purposes, there is one that stands above the rest. From Wireshark's website. Wireshark is the world's foremost and widely used network protocol analyzer. It lets you see what's happening on your network at a microscopic level, and is the de facto, and also dejour standard, across many commercial and nonprofit enterprises, government agencies, and educational institutions. Wireshark development thrives, thanks to the volunteer contributions of networking experts around the globe, and is the continuation of a project started by Gerald Combs in 1998.

Network Security: Rainbow Table

A rainbow table attack is an alternative to a dictionary attack. The dictionary attack will require a lot of time to parse through all the words and the subsequent hashing of them. Plus, the file itself, if good, will be quite large. If the hashes are stored, the storage requirements are even greater because instead of a password of around a length of ten, we're now talking about hashes that are ten or 20 times the length of passwords. The rainbow table is a trade-off, using less processing and more storage than a brute force attack but more processing and less storage than a dictionary attack. A rainbow table involves an algorithm called a reduction function that maps hashes into something that could be an actual plaintext password. This does not mean we're reversing the hash; it can't be done. The rainbow table is just alternating hashing and reducing to produce a chain of alternating hashes and plaintext. For example, we can take plaintext "Jonathan" and hash it into "123456". Then we could run "123456" through a reduction function and get "Scott". Then we could run Scott through the hashing algorithm and get "abcdef" and reduce that to "Weisman". Generating a rainbow table with a tool called Rtgen, for instance, involves computing a number of chains with a specific chain length and storing the first and last entries of each chain. Thus, instead of storing 10,000 plaintext values or hashes, which, at most, can crack 10,000 passwords, now storing just the starting and ending point of 5,000 chains -- the same number of 10,000 entries -- a rainbow table can crack any amount of passwords; 100,000, a million, a billion, or more!

Network Security: Packet Sniffing

Packet sniffers can provide so much insight to network traffic.

•     They can monitor data in motion -- serve as primary data source for day-to-day network monitoring and management.
•     Monitor network usage, including internal and external users and systems.
•     Gather and report network statistics.
•     Verify adds, moves, and changes.
•     Verify internal control system effectiveness in firewalls, access control lists, web filters, spam filters, and proxies.
•     Document regulatory compliance through logging all perimeter and end point traffic.
•     Monitor WAN Bandwidth utilization.
•     Monitor WAN and endpoint security status.
•     Analyze network problems.
•     Debug client server communications.
•     Debug network protocol implementations.
•     Gain information for carrying out a network intrusion.
•     Spy on other network users by eavesdropping on unencrypted data.
•     Collect sensitive information, such as login details or user cookies, depending upon encryption being used.
•     And, capture packets for subsequent playback in replay, man-in-the-middle, and packet injection attacks.
•     Reverse engineer proprietary protocols used over the network.
•     Detect network intrusion attempts.
•     Detect network misuse by internal and external users.
•     Filter suspect content from network traffic.

                               

Network Security: IP Packets and Packet Sniffing

IP packets, which exist at layer three of the OSI model are encapsulated inside of layer two frames.

• On wired lens, they are ethernet frames. 
• On wireless lens, they are 802.11 frames. 

In the context of capturing and analyzing network traffic, even though the lowest unit to analyze is the frame, it's still called packet sniffing. Every single bit -- all the ones and zeros that go in and out of a NIC (network interface card) can be seen and analyzed. There's an option to see them in true binary. Even hexadecimal. But, as humans, we prefer a format that is more intuitive.

A packet sniffer implemented in software or hardware will not only intercept and log all the ones and zeros moving in and out of a nic, but show it to us, humans, in a human-readable format. In addition to binary and hexadecimal. All of the fields of every single frame, packet, segment, data gram, and upper layer data will be shown with their names. Along with their corresponding data values.

For example, in the IP packet, source IP address -- x.x.x.x (192.168.1.113). Destination IP address -- x.x.x.x (192.168.1.107). We will see the content as they're listed in the RFC, or other specifications.

Cyber Security: Network Security - Quiz

Question 1
What is the role of a personal firewall?

• To protect the network to which your computer is attached from attacks that come from outside the network
• To protect your computer and the devices attached to it as an extra layer of security
• To protect your computer so that you don’t need to use any other firewalls
• To encrypt the data coming to and from your computer

  Question 2
You are recommending a networking solution for an organisation that is based in several locations and wants to exchange data securely between those locations and with its mobile sales force. Which of the following would be the most practical option?

• Leased lines
• LANs
• Encryption
• VPNs

  Question 3
For what purpose are hashes, MACs and digital signatures used in a VPN?

• To provide authentication and ensure integrity
• To ensure confidentiality and availability
• To ensure integrity and availability
• To ensure confidentiality and provide authentication

Question 4
Which method of intrusion detection looks for unusual patterns of network use to warn system administrators that there might be a problem?

• Digital signatures
• VPN tunnelling
• Anomaly detection
• Misuse detection
• Intrusion prevention

Question 5
What is the term used for an isolated computer that can be used by researchers to study new types of attack?

• Botnet
• Zombie
• Tunnel
• Honeypot
• Misuse detection

Cyber Security: Network security challenges

       

Internet routers are designed to move datagrams to their destination but how secure are they?

They have been designed to move datagrams to their destination and have been programmed with strategies to overcome problems such as congestion or the failure of a part of the network. These strategies involve re-routing datagrams via any alternative direction. Therefore, it is impossible to state with any assurance which route will be taken by a datagram travelling outside a local network.

The datagram may travel directly, or, more probably, travel through several routers located anywhere in the world. These routers will most probably not belong to either the sender or the recipient, but a third party. In most cases this will not matter, but datagrams can be copied, and their security compromised, as they pass through a router without alerting either the sender or receiver.

The process is known as packet sniffing and it has many legitimate purposes including analysing network performance and for law enforcement, but packet sniffing software is readily available to anyone who chooses to use it. In the past, packet sniffing required a computer that was wired to the network, but wireless networking means this is no longer the case.
               
Security risks of wireless networking
Since wireless networks transmit data over a medium that is shared by everyone, anyone with a compatible receiver or transceiver is able to eavesdrop on the radio signals being sent.

Ensuring that the eavesdropper is not able to convert these signals into the original message is a desirable security property of any wireless network, referred to as ensuring confidentiality. (This was one of the three security essentials we mentioned earlier, along with integrity and availability.)

Another security problem with using a shared medium for transmission is that malicious users could interpose themselves between a sender and a receiver and modify the messages being exchanged or even destroy them entirely. This is sometimes called a ‘man-in-the-middle attack’, and it compromises the integrity of the data being transmitted across the network.

  

Finally, an attacker could transmit lots of random data on the frequency being used by the wireless network, congesting the network and thus preventing other users from sending data. As we saw earlier in the course, this is called a ‘denial of service’ (DoS) attack and is an example of an attack on the availability of the network.

How encryption can help
So how do wireless networks address these potential security issues?
One commonly used security mechanism is encryption, which can help to ensure both the confidentiality and the integrity of data. The idea of encryption is to take the information you wish to protect and transform it into a different form, such that only the people who are supposed to receive the information are able to reverse the transformation and recover the original information. This is like having a key to unlock a door; only a person with the right key can open it.

Encryption can help ensure:

• Confidentiality – When a message is encrypted using a particular key, it can only be decrypted to recover the original information if the same key is used. This ensures that messages are confidential between the sender and the receiver.
• Integrity – Encryption can prevent messages from being modified without the receiver’s knowledge.
• Authentication – Encryption can contribute to the process of proving the identities of the sender and receiver.

© The Open University

Network Security - OSI Layer - Summary

• Application - (layer 7) Allows applications to use the network. Handles network access, flow control and error recovery. messages are sent between layers

Protocols - SMB, NCP
Services - Telnet, FTP use TCP, TFTP, NFS, SNMP, SMTP use TCP
Functions - User interface with applications & Gateways

• Presentation - (layer 6) Translates data into a form usable by the application layer. The redirector operates here. Responsible for protocol conversion, translating and encrypting data, and managing data compression. messages are sent between layers

Protocols - NCP
Services - Telnet, FTP use TCP, TFTP, NFS, SNMP, SMTP use TCP
Functions - Gateways

• Session - (layer 5) Allows applications on connecting systems to establish a session. Provides synchronization between communicating computers. messages are sent between layers

Protocols - N/A
Services - Telnet, FTP use TCP, TFTP, NFS, SNMP, SMTP use TCP
Functions - Gateways

• Transport - (layer 4) Responsible for packet handling. Ensures error-free delivery. Repackages messages, divides messages into smaller packets, and handles error handling. segments of message fragments are sent between layers

Protocols - SPX, TCP, UDP and NetBEUI function on this layer
Services - TCP/SPX - connection-oriented communication for applications to ensure error free delivery; UDP - connectionless communications and does not guarantee packet delivery between transfer points
Functions - Gateways function on this layer

• Network - (layer 3) Translates system names into addresses. Responsible for addressing, determining routes for sending, managing network traffic problems, packet switching, routing, data congestion, and reassembling data. Datagrams are sent between layers

Protocols - IPX, IP, ICMP, ARP, RARP, RIP, OSPF, EGP, IGMP, NetBEUI, DLC, and DecNET function on this layer
Services - software & hardware addresses and packet routing between hosts and networks (IP/IPX); software addresses to hardware addresses are resolved (ARP/RARP), sends messages and reports errors regarding packet delivery (ICMP), reports host group membership to local multicast routers (IGMP)
Functions - Routers and Brouters function up to this layer

• Data link - (layer 2) Sends data from network layer to physical layer. Manages physical layer communications between connecting systems. Data frames are sent between layers

Protocols - HDLC (High-level Data Link Control); Supports asynchronous and synchronous transmissions. Uses LLC flow control
Services - Ethernet, Token Ring, and other communications occur here via frames. LLC - (802.2) Manages link control and defines SAP's (Service Access Points). MAC - (802.3, 802.4, 802.5, 802.12) Communicates with adapter card.
Functions - Switches, brouters and bridges function on this layer using the MAC sublayer

• Physical - (layer 1) Transmits data over a physical medium. Defines cables, cards, and physical aspects. Data bits are sent.

Protocols - No protocols function on this layer
Services - Ethernet (CSMA/CD), Token Ring (token passing), and other communications occur
Functions - Repeaters and multiplexers function on this layer; bits are sent across the wire