OSI model
Seven-layer reference model, physical to application, used to place protocols, devices, and attacks at the layer where they operate; a common framework for classifying them.
The OSI model is the seven-layer reference model that describes how data moves from an application onto the wire. Layer 1 (physical) transmits raw bits; layer 2 (data link) frames them and addresses by MAC, the layer where a VLAN lives; layer 3 (network) routes packets by IP, home of IPsec; layer 4 (transport) delivers end to end via TCP or UDP; layer 5 (session) manages dialogues; layer 6 (presentation) handles encoding and encryption formats; layer 7 (application) provides the services users actually touch.
The model is a teaching abstraction, not a protocol stack anyone runs, and questions in this area tend to trade on that by asking where a device, protocol, or attack operates: switches at layer 2, routers at layer 3, ARP poisoning at layer 2, SYN floods at layer 4. The four-layer TCP/IP model is the mapping trap: its network access layer covers OSI 1 and 2, internet maps to 3, transport to 4, and its single application layer absorbs OSI 5, 6, and 7. TLS sits awkwardly above transport, usually placed at session or presentation.
Exam relevance: layer placement decides these questions. If a scenario mentions MAC addresses, frames, or switches, the answer is layer 2; IP addresses and routers point to layer 3; ports and TCP flags point to layer 4. Contrast the TCP/IP model: when a question says the application layer includes session management, it is describing TCP/IP, not OSI, where those are three separate layers.