OSI vs TCP/IP Layer Mapping — A Cheat Sheet for the N10-009 Exam

Every Network+ exam attempt has 10–15 questions that test whether you can map a protocol, a piece of hardware, or a troubleshooting symptom to the correct OSI layer. Get those right and you bank 15 points. Get them confused and you lose a passing score over avoidable mistakes.

The good news: layer questions are pure memorization with a tight set of mappings. This post is the complete cheat sheet — OSI’s 7 layers, TCP/IP’s 4 layers, the protocols that live at each, the hardware that operates there, and the specific traps the exam uses to catch people who memorized half the table.

The two models side by side

The single sentence to memorize: TCP/IP collapses OSI 5/6/7 into one Application layer and OSI 1/2 into one Network Access layer. Everything else maps 1:1.

The N10-009 exam uses both models. When a question says “layer 7” it means OSI. When it says “Application layer” it usually means TCP/IP (because TCP/IP layers are named, not numbered). Read carefully.

Layer-by-layer with protocols, PDUs, and hardware

The full cheat sheet. Memorize column 2, 3, and 4 for each row — that covers ~80% of the layer questions.

The PDU (Protocol Data Unit) naming pattern is a classic exam-question target. Memorize: Bit → Frame → Packet → Segment → Data → Data → Data going up the stack. The exam asks “what is the PDU at layer 4?” expecting “segment” (for TCP) or “datagram” (for UDP).

The encapsulation flow

When an HTTP request leaves your laptop, this is what happens to the data:

Layer 7  Application:    "GET /index.html HTTP/1.1"
                              │
Layer 4  Transport:      [TCP header | "GET /index.html HTTP/1.1"]
                              │
Layer 3  Network:        [IP header | TCP header | "GET ..."]
                              │
Layer 2  Data Link:      [Ethernet header | IP header | TCP header | "GET ..." | Ethernet trailer]
                              │
Layer 1  Physical:       10101110010110010001011010001101...

Each layer wraps the previous layer’s PDU with its own header (and sometimes a trailer at layer 2). On the receiving side, each layer strips off its own header and hands the inner PDU upward.

The exam asks encapsulation in three ways:

• “What header is added at layer 3?” → IP header
• “What is the PDU after layer 2 encapsulation?” → Frame
• “In what order are headers added as data moves down the stack?” → Application → Transport → Network → Data Link → Physical

Where each common protocol lives (memorize this table)

The single most-frequently-tested protocol-to-layer mapping table. Memorize this and you have 10 points in the bank.

The exam traps you must know

Five layer-mapping traps the N10-009 uses repeatedly.

Trap 1 — ARP is layer 2 or layer 3?

ARP (Address Resolution Protocol) translates IP addresses to MAC addresses. It uses both an IP address (layer 3) and a MAC address (layer 2). Different sources put it at different layers.

Exam answer: Layer 2 (Data Link). CompTIA places ARP at layer 2 because it deals with MAC-address resolution within a broadcast domain — the function is L2 even though it carries an L3 address inside the request. If the question gives layer 3 as an option and not layer 2, take layer 3.

Trap 2 — TLS / SSL is layer 5 or 6 or 7?

TLS encrypts application-layer traffic but isn’t itself an application. Various sources put it at 5, 6, or 7.

Exam answer: Layer 6 (Presentation). TLS handles encryption/encoding — the canonical Presentation-layer responsibility. Some questions accept layer 5 (Session) because TLS also negotiates sessions, but if both are options, take layer 6.

Trap 3 — Layer-3 switch vs router

Both forward IP packets at layer 3. The exam may ask “which is the layer-3 device?”

Exam answer: Both are layer-3 devices. The trap is questions that include only one in the options. If only “router” is listed, take it. If only “layer-3 switch” is listed, take it. If both are options, look for a distinguishing detail in the question (routing protocols → router; high-speed inter-VLAN routing within a campus → layer-3 switch).

Trap 4 — NGFW operating layer

A next-generation firewall does packet filtering (L3), state tracking (L4), and application inspection (L7). The exam may ask “what is the operating layer of an NGFW?”

Exam answer: Layer 7 if asked for the highest layer. Multiple layers (3–7) if a “select all that apply” question. If the question simply says “firewall” without “next-generation,” default to L3/L4.

Trap 5 — DNS uses TCP or UDP?

Both. Default queries use UDP port 53. Zone transfers (and large responses, like with DNSSEC) use TCP port 53.

Exam answer: Look for keywords. “Query” or “lookup” → UDP. “Zone transfer” → TCP. “What transport protocol does DNS use” with no qualifier → UDP (most common), but the technically-correct answer is “both” if it’s an option.

The hardware-to-layer mapping

Almost as commonly tested as protocols.

Why the OSI model is still worth knowing in 2026

Some practitioners argue OSI is dead — nothing implements all 7 layers; everything runs TCP/IP. They’re not wrong about the implementation, but the OSI taxonomy is how we name things in the industry.

When you say “layer 2 issue,” everyone in the room thinks switches, MAC tables, ARP, STP, spanning-tree loops. When you say “layer 7 issue,” everyone thinks app crashes, HTTP errors, malformed JSON. The vocabulary is the model’s persistent value, even when the underlying stack is TCP/IP.

It’s also how vendors price and label equipment. “Layer 3 switch,” “layer 4 load balancer,” “layer 7 firewall” — those phrases set price points in the buyer’s mind. As a Network+ candidate (or a future SE), speaking the OSI vocabulary is table stakes.

How to study this for the exam

Three-pass strategy that takes about 90 minutes total:

Pass 1 (30 min) — read this post, identify the layers and protocols you don’t immediately recall, write them on flashcards. Focus on the protocol-to-layer table.

Pass 2 (30 min) — flashcards both directions (protocol → layer, layer → protocol). Then hardware → layer flashcards.

Pass 3 (30 min) — practice questions. Pick 30 random “what layer is X?” questions and answer in under 10 seconds each. Anything you miss goes back into the flashcard deck.

After this, layer questions on the actual exam take you 10–15 seconds each, leaving you more time for the subnetting questions that need the calculation work — which is the magic-number method post.

Where to take this next

If you want a port-number reference card (the related memorization grind for the N10-009), Port Numbers Worth Memorizing for Network+ (and Which Ones You Can Skip) breaks down which to memorize cold.

If your subnetting still slows you down, Subnetting Without a Calculator — The Magic-Number Method is the technique that gets you to 30 seconds per problem.