Worked Solutions · AP CSP-Feeder · US / ON / BC / AB Styles解题详解 · AP CSP 衔接 · 美 / 安 / 卑 / 阿省风格
Correct answer: (B)正确答案：(B)
Why not (A): WAN spans large distances; mesh means every device connects to every other. Why not (C): bus = one shared cable; a switch does not emulate a bus. Why not (D): connecting to the Internet makes the library part of a WAN, but the local network itself is a LAN.排除 (A)：广域网跨越大距离；网状型指每台设备与其他所有设备连接。排除 (C)：总线型 = 一条共享电缆；交换机不模拟总线。排除 (D)：连接到互联网使图书馆成为广域网的一部分，但本地网络本身是局域网。
The key discriminators: LAN vs WAN = geographic scope (one building vs. large distances). Star vs. bus vs. mesh = how devices connect (central switch vs. single cable vs. everyone to everyone). Most real-world LANs use star topology because a switch failure is the only single point of failure, not a cable break affecting all devices simultaneously.关键区分点：局域网 vs 广域网 = 地理范围（一栋建筑 vs 大距离）。星型 vs 总线型 vs 网状型 = 设备如何连接（中央交换机 vs 单一电缆 vs 互连所有设备）。现实中大多数局域网使用星型拓扑，因为唯一的单点故障是交换机故障，而非同时影响所有设备的电缆断裂。
Correct answer: (B)正确答案：(B)
Why not (A): resending all 2,700 would be inefficient and defeats the purpose of packet switching. Why not (C): TCP cannot reconstruct missing data from adjacent packets. Why not (D): TCP's retransmission mechanism exists precisely to recover from lost packets without a full restart.排除 (A)：重传全部 2,700 个数据包效率低下，违背了分组交换的目的。排除 (C)：TCP 无法从相邻数据包重建丢失数据。排除 (D)：TCP 的重传机制正是为了在无需完全重启的情况下恢复丢失的数据包。
Selective retransmission is one of three core advantages of packet switching. The others are: (1) packets can take different routes simultaneously (parallel throughput), and (2) bandwidth is shared fairly among many users. AP CSP CSN-1.A assesses all three benefits together.选择性重传是分组交换三大核心优势之一。其他两个是：（1）数据包可以同时走不同路径（并行吞吐），（2）带宽可在多个用户间公平共享。AP CSP CSN-1.A 同时评估所有三项优势。
www.school.ca) into IP addresses (e.g. 93.184.1.5) that routers can use to forward packets to the correct destination.DNS = 域名系统（Domain Name System）。其作用是将人类可读的域名（如 www.school.ca）翻译成路由器可以转发数据包到正确目的地的 IP 地址（如 93.184.1.5）。school.ca. The authoritative server returns the IP address; the resolver sends it back to the browser.按顺序的四个实体：（1）DNS 解析器（你的路由器/ISP），（2）根 DNS 服务器，（3）.ca TLD（顶级域）DNS 服务器，（4）school.ca 的权威 DNS 服务器。权威服务器返回 IP 地址；解析器将其发送回浏览器。DNS is the Internet's "phone book." Remember the hierarchy: Resolver asks Root, Root points to TLD, TLD points to Authoritative. The result is cached at each level with a TTL (Time To Live) value. Without DNS you would need to memorise a 32-bit dotted-decimal address for every website you visit.DNS 是互联网的"电话簿"。记住层级结构：解析器询问根服务器，根服务器指向 TLD，TLD 指向权威服务器。结果在每一层都以 TTL（生存时间）值缓存。没有 DNS，你需要记住每个网站的 32 位点分十进制地址。
Online banking site: TCP. Banking requires 100% accuracy; every byte of transaction data must arrive correctly and in order. TCP's handshake, ACK, and retransmission mechanism guarantee reliable delivery. A missing or corrupted byte in a bank transfer is unacceptable.在线银行网站：TCP。银行业务需要 100% 准确性；每一个字节的交易数据必须正确且按序到达。TCP 的握手、ACK 和重传机制保证可靠传输。银行转账中丢失或损坏的字节是不可接受的。
Live video streaming: UDP. Streaming prioritises low latency over accuracy; a dropped video frame appears as a brief glitch, which is far preferable to a frozen screen caused by waiting for TCP retransmissions. UDP's connectionless, no-ACK design is faster.实时视频流：UDP。流媒体优先考虑低延迟而非准确性；丢失的视频帧表现为短暂卡顿，这远好于等待 TCP 重传导致的画面冻结。UDP 的无连接、无 ACK 设计更快。
The protocol choice rule: when accuracy matters more than throughput, use TCP; when low latency matters more than accuracy, use UDP. Every web page (HTTP/HTTPS) uses TCP. Real-time communications (VoIP, live video, online gaming) use UDP. The "S" in HTTPS stands for Secure, implemented via TLS at OSI Layer 6 (Presentation).协议选择原则：当准确性比传输效率更重要时，使用 TCP；当低延迟比准确性更重要时，使用 UDP。每个网页（HTTP/HTTPS）使用 TCP。实时通信（VoIP、实时视频、在线游戏）使用 UDP。HTTPS 中的"S"代表 Secure（安全），通过 OSI 第 6 层（表示层）的 TLS 实现。
| Layer #层编号 | Name名称 | Protocol / Hardware Example协议/硬件示例 |
|---|---|---|
| 7 | Application应用层 | HTTP, HTTPS, DNS, FTPHTTP、HTTPS、DNS、FTP |
| 6 | Presentation表示层 | TLS/SSL, JPEG, MP3TLS/SSL、JPEG、MP3 |
| 4 | Transport传输层 | TCP, UDPTCP、UDP |
| 3 | Network网络层 | IP, ICMP, routersIP、ICMP、路由器 |
| 1 | Physical物理层 | Fibre optic cable, radio waves光纤电缆、无线电波 |
(Bold text = answers to fill in; italic text = given in the question.)（粗体 = 填写答案；斜体 = 题目已给出。）
Mnemonic (7 down to 1): All People Seem To Need Data Processing. For BC CIS 11, know all seven names plus representative protocols. For AP CSP, understand the conceptual purpose of layering. The key BC CIS 11 term is "interoperability" - the OSI model is an ISO standard (ISO/IEC 7498-1) that enables all compliant devices to communicate regardless of manufacturer.记忆口诀（7 到 1）：应用-表示-会话-传输-网络-数据链路-物理。BC CIS 11 需要记住所有七层名称及代表性协议。AP CSP 需要理解分层的概念目的。BC CIS 11 关键术语是"互操作性"，即 OSI 模型是 ISO 标准（ISO/IEC 7498-1），使所有符合标准的设备无论制造商如何都能通信。
Key numbers to know: IPv4 = 32 bits, ~4.3 billion addresses. IPv6 = 128 bits, ~3.4 x 10^38 addresses. Private ranges: 192.168.x.x, 10.x.x.x, 172.16-31.x.x. The transition from IPv4 to IPv6 is driven purely by address exhaustion, not by throughput, encryption, or wireless support.关键数字：IPv4 = 32 位，约 43 亿个地址。IPv6 = 128 位，约 3.4 x 10^38 个地址。私有范围：192.168.x.x、10.x.x.x、172.16-31.x.x。从 IPv4 到 IPv6 的迁移纯粹由地址耗尽驱动，而非传输性能、加密或无线支持。
TCP 3-way handshake (in order):TCP 三次握手（按顺序）：
Connection setup order for HTTPS: (1) DNS lookup, (2) TCP 3-way handshake (SYN, SYN-ACK, ACK), (3) TLS handshake (exchange certificates, agree on cipher), (4) HTTP GET request (encrypted). Steps 1-3 all occur before any application data is sent. Network ownership does not guarantee data security - encryption is the only guarantee.HTTPS 连接建立顺序：（1）DNS 查找，（2）TCP 三次握手（SYN、SYN-ACK、ACK），（3）TLS 握手（交换证书、协商密码），（4）HTTP GET 请求（加密）。在发送任何应用数据之前，步骤 1-3 全部发生。网络所有权不保证数据安全；加密才是唯一保证。
The OSI layer mapping for HTTPS traffic: Application (7) = HTTP, Presentation (6) = TLS, Session (5) = connection management, Transport (4) = TCP, Network (3) = IP, Data Link (2) = Ethernet/Wi-Fi, Physical (1) = copper/fibre/radio. Encapsulation is the reverse of decapsulation: each layer adds its wrapper going down and removes it going up. BC CIS 11 explicitly tests this and the ISO standard ISO/IEC 7498-1 that formalises the OSI model.HTTPS 流量的 OSI 层映射：应用层（7）= HTTP，表示层（6）= TLS，会话层（5）= 连接管理，传输层（4）= TCP，网络层（3）= IP，数据链路层（2）= 以太网/Wi-Fi，物理层（1）= 铜线/光纤/无线电。封装是解封装的逆过程：每层向下添加其包装，向上则移除。BC CIS 11 明确测试此内容以及使 OSI 模型正式化的 ISO 标准 ISO/IEC 7498-1。
Sender --[Router A]--[Router B]--[Router C]-- Receiver
| |
+------[Router D]-------+Two distinct paths:两条不同路径：
AP CSP CSN-1.C: "The Internet is designed to be fault tolerant, with redundancy being the primary mechanism for fault tolerance." The key word is redundancy - multiple paths, multiple routers, no single critical node. Sequence numbers in TCP headers enable both reordering of out-of-order packets AND detection of missing packets (gaps in the sequence trigger retransmission). Star topology vs. mesh: star is simple and cheap but has one SPOF; mesh is expensive but extremely resilient.AP CSP CSN-1.C："互联网被设计为容错的，冗余是容错的主要机制。"关键词是冗余，即多条路径、多个路由器、无单一关键节点。TCP 头部中的序列号既能重新排序乱序数据包，又能检测丢失数据包（序列中的间隙触发重传）。星型拓扑 vs 网状拓扑：星型简单便宜但有一个单点故障；网状型昂贵但极具弹性。
Sample labelled diagram:带标注图示示例：
PC1 ----+
PC2 ----+
PC3 ----+ [Internet / WAN]
: +---- [Switch] ---- [Router] ----+
: +
PC20 ---+
LAN (star topology) WAN connectionKey components: [Switch] = central device (star hub), 20 PCs connect to Switch, [Router] connects LAN to Internet. Award marks for: correct topology shown (star), central device labelled as Switch, Router present and connecting to Internet cloud, at least 3 PCs shown.关键组件：[交换机] = 中央设备（星型中心），20 台 PC 连接到交换机，[路由器] 将局域网连接到互联网。评分点：正确的拓扑结构（星型）、中央设备标注为交换机、路由器存在并连接到互联网云、至少显示 3 台 PC。
Star topology is the dominant LAN topology today because switches are cheap, reliable, and provide dedicated bandwidth to each device. The only failure mode that affects the whole network is the switch. In enterprise networks, redundant (dual) switches are used to eliminate this SPOF. The three packet-switching benefits (parallel routing, selective retransmission, fair sharing) are directly assessed by AP CSP CSN-1.A and CSTA 3A-NI-04.星型拓扑是当今主流的局域网拓扑，因为交换机廉价、可靠，并为每台设备提供专用带宽。影响整个网络的唯一故障模式是交换机故障。在企业网络中，使用冗余（双）交换机来消除此单点故障。分组交换的三个优势（并行路由、选择性重传、公平共享）直接由 AP CSP CSN-1.A 和 CSTA 3A-NI-04 评估。
(i) Trojan. The program disguised itself as a game (legitimate software) while secretly performing malicious actions (transmitting files to an external server). A Trojan does not self-replicate; it relies on the user to install it.（i）木马。该程序伪装成游戏（合法软件），同时秘密执行恶意操作（将文件发送到外部服务器）。木马不会自我复制；它依赖用户主动安装。
(ii) Worm. The software spread from computer to computer across the network without needing to attach to any file. This self-replication without a host file is the defining characteristic of a worm, distinguishing it from a virus (which attaches to a file) and a Trojan (which does not replicate).（ii）蠕虫。该软件无需附着于任何文件即在网络中从一台计算机传播到另一台。这种无需宿主文件的自我复制是蠕虫的定义性特征，将其与病毒（附着于文件）和木马（不复制）区分开来。
(iii) This is not malware - it is unauthorised access / account compromise (an attacker guessing a weak password). The correct category is a brute-force or dictionary attack exploiting a weak password, which is a network security breach rather than a malware infection. Accept: "password attack" or "unauthorised access via credential guessing."（iii）这不是恶意软件，而是未授权访问/账户泄露（攻击者猜测弱密码）。正确类别是利用弱密码的暴力破解或字典攻击，这是网络安全漏洞而非恶意软件感染。接受答案："密码攻击"或"通过凭证猜测的未授权访问"。
| Incident事件 | Security Measure安全措施 | Tradeoff权衡 |
|---|---|---|
| (i) Trojan木马 | Install and maintain anti-malware software with real-time scanning; restrict students from installing unapproved software (application whitelist).安装并维护具有实时扫描功能的反恶意软件；限制学生安装未经批准的软件（应用白名单）。 | Ongoing software licensing cost; real-time scanning may slow system performance. Whitelist reduces student flexibility for legitimate software needs.持续的软件许可成本；实时扫描可能降低系统性能。白名单降低学生对合法软件需求的灵活性。 |
| (ii) Worm蠕虫 | Apply regular operating system patches and security updates promptly; configure the firewall to block lateral movement (restrict peer-to-peer connections between student devices).及时应用定期操作系统补丁和安全更新；配置防火墙阻止横向移动（限制学生设备之间的点对点连接）。 | Patch management requires IT staff time and testing to avoid breaking applications. Restricting device-to-device connections may interfere with legitimate collaborative activities.补丁管理需要 IT 人员时间和测试，以避免破坏应用程序。限制设备间连接可能干扰合法的协作活动。 |
| (iii) Weak password / unauthorised access弱密码/未授权访问 | Enforce a strong password policy (minimum length, complexity, rotation) AND require multi-factor authentication (MFA) for Wi-Fi and system access.强制执行强密码策略（最小长度、复杂性、轮换），并要求多因素认证（MFA）用于 Wi-Fi 和系统访问。 | MFA adds an extra step for every login, reducing convenience for staff. Strong password requirements increase the likelihood of staff writing down passwords if requirements are too complex.MFA 为每次登录增加额外步骤，降低员工便利性。若密码要求过于复杂，强密码要求会增加员工写下密码的可能性。 |
The three malware types to know cold for ICS3U C2.2: Virus (attaches to file, spreads when file is shared), Worm (self-replicates across network, no host file needed), Trojan (disguised as legitimate software, does not replicate). Ransomware (encrypts files for payment) and Spyware (secretly monitors) complete the five core types. For any security question in CSTA 3A-NI-06 to 3A-NI-08: name the threat, name the measure, name the tradeoff. All three elements are required for full marks.ICS3U C2.2 需要熟记的三种恶意软件类型：病毒（附着于文件，文件共享时传播），蠕虫（在网络中自我复制，无需宿主文件），木马（伪装成合法软件，不复制）。勒索软件（加密文件索取赎金）和间谍软件（秘密监视）构成五种核心类型。对于 CSTA 3A-NI-06 到 3A-NI-08 的任何安全问题：命名威胁、命名措施、命名权衡。三个要素都是满分所必需的。
https://library.school.ca:443/catalogue?subject=science#results
| | | | | |
scheme domain port path query string fragmenthttps (scheme/protocol): specifies the communication protocol to use - HTTP with TLS encryption for secure transmission.https（协议方案）：指定使用的通信协议，即带 TLS 加密的 HTTP，用于安全传输。library.school.ca (domain): the human-readable name of the server; DNS will resolve this to an IP address.library.school.ca（域名）：服务器的人类可读名称；DNS 将把它解析为 IP 地址。443 (port): the network port on the server to connect to (443 is the standard/default port for HTTPS).443（端口）：要连接的服务器上的网络端口（443 是 HTTPS 的标准/默认端口）。/catalogue (path): the specific resource or page on the server being requested./catalogue（路径）：服务器上被请求的特定资源或页面。subject=science (query string): parameters passed to the server to filter or modify the response (here: filter results by subject=science).subject=science（查询字符串）：传递给服务器以过滤或修改响应的参数（此处：按 subject=science 过滤结果）。#results (fragment): an in-page anchor that tells the browser to scroll to the element with id="results" after the page loads; the fragment is NOT sent to the server.#results（片段）：页内锚点，指示浏览器在页面加载后滚动到 id="results" 的元素；片段不发送给服务器。library.school.ca into an IP address (e.g. 192.168.10.5).DNS 步骤：浏览器向 DNS 解析器查询，将 library.school.ca 翻译为 IP 地址（如 192.168.10.5）。GET /catalogue?subject=science HTTP/1.1 with Host header library.school.ca, encrypted by TLS.客户端发送：完成 TCP（和 TLS）握手后，浏览器（客户端）发送 HTTP GET 请求：GET /catalogue?subject=science HTTP/1.1，Host 头部为 library.school.ca，由 TLS 加密。200 OK, a Content-Type header, and the HTML body of the catalogue page, all TLS-encrypted.服务器返回：Web 服务器处理请求并返回 HTTP 响应，包含状态码 200 OK、Content-Type 头部和目录页面的 HTML 正文，全部经 TLS 加密。#results anchor.浏览器处理：浏览器解密响应，解析 HTML，在屏幕上渲染页面，并滚动到 #results 锚点。URL anatomy (memorise the structure): scheme://domain:port/path?query#fragment. The fragment (#...) is the only part NOT sent to the server - it is processed entirely by the browser. Internet vs Web: the Internet (ARPANET, 1969) predates the Web (Tim Berners-Lee, 1989) by 20 years. Other non-Web Internet services: email (SMTP/IMAP/POP3), file transfer (FTP), video calls (VoIP/RTP), online gaming, DNS itself, IoT devices. The Web is specifically HTTP/HTTPS hypertext documents.URL 结构（记住）：协议://域名:端口/路径?查询#片段。片段（#...）是唯一不发送给服务器的部分，由浏览器完整处理。互联网 vs 万维网：互联网（ARPANET，1969）比万维网（Tim Berners-Lee，1989）早 20 年。其他非万维网的互联网服务：电子邮件（SMTP/IMAP/POP3）、文件传输（FTP）、视频通话（VoIP/RTP）、在线游戏、DNS 本身、物联网设备。万维网特指 HTTP/HTTPS 超文本文档。