I85PREP
⌘ K
BCS Written ICT study materials
BCS Written ICT study resources

BCS Written ICT practice questions

One question at a time. Build your BCS Written ICT understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Computer Fundamentals and Hardware

Which component of a computer is described as the 'brain' that fetches, decodes and executes instructions?

  1. The power supply unit
  2. The hard disk drive
  3. The random access memory
  4. The central processing unit Correct answer.

Explanation

The central processing unit carries out the fetch-decode-execute cycle, interpreting program instructions and directing other units to perform the required operations. Memory and storage only hold data and instructions, while the power supply merely delivers electrical energy. Execution of logic and arithmetic therefore belongs to the CPU.

Question 2Computer Fundamentals and Hardware

Which type of memory loses its stored contents when the computer is switched off?

  1. Magnetic tape
  2. Read-only memory
  3. Flash memory
  4. Volatile memory Correct answer.

Explanation

Volatile memory, of which dynamic RAM is the common example, requires continuous electrical power to retain its contents and is cleared at power-off. ROM, flash memory and magnetic tape all retain data without power and are therefore non-volatile. The distinction rests on power dependence, not on speed or capacity.

Question 3Computer Fundamentals and Hardware

In the context of computer storage, what does the abbreviation SSD stand for?

  1. Secure Sector Disk
  2. Serial Storage Disk
  3. System Storage Device
  4. Solid State Drive Correct answer.

Explanation

SSD denotes a solid state drive, a storage device built from flash memory chips with no moving parts. Because it has no spinning platters or moving heads, it offers faster access and greater shock resistance than a mechanical disk. The other expansions are invented phrases that do not describe this technology.

Question 4Computer Fundamentals and Hardware

Which number system uses only the digits 0 and 1 and is the natural language of digital circuits?

  1. Octal
  2. Binary Correct answer.
  3. Hexadecimal
  4. Decimal

Explanation

Binary uses exactly two symbols, 0 and 1, which map directly onto the two stable voltage states of digital logic. Octal and hexadecimal are compact shorthand notations built on binary groups but use eight and sixteen symbols respectively. Decimal uses ten symbols and requires conversion before a circuit can process a value.

Question 5Computer Fundamentals and Hardware

Which unit is the smallest addressable storage location in main memory?

  1. The word
  2. The bit
  3. The nibble
  4. The byte Correct answer.

Explanation

Main memory is addressed in bytes, so each distinct memory address refers to one 8-bit byte. A bit is a single binary digit and cannot be addressed individually, while a nibble is half a byte and a word is a processor-dependent grouping. Addressability therefore belongs to the byte.

Question 6Computer Fundamentals and Hardware

Which of the following is an example of an input device?

  1. A barcode scanner Correct answer.
  2. A plotter
  3. A monitor
  4. A speaker

Explanation

Input devices send data from the outside world into the computer, and a barcode scanner converts printed codes into digital signals for processing. Monitors, speakers and plotters work in the opposite direction, presenting processed results to the user. The direction of data flow determines the classification.

Question 7Computer Fundamentals and Hardware

Convert the binary number 1011 to its decimal equivalent.

  1. 13
  2. 11 Correct answer.
  3. 15
  4. 9

Explanation

Each binary digit carries a place value of a power of two, so 1011 equals 8 + 0 + 2 + 1. Summing those place values gives 11 in decimal. The zero in the fours position must be respected, otherwise the total is overestimated.

Question 8Computer Fundamentals and Hardware

What is the hexadecimal representation of the decimal number 255?

  1. FE
  2. 1F
  3. F0
  4. FF Correct answer.

Explanation

Decimal 255 equals 15 multiplied by 16 plus 15, and each 15 is written as F in hexadecimal. The result is therefore FF, the largest two-digit hexadecimal value. The other options decode to 254, 240 and 31 respectively.

Question 9Computer Fundamentals and Hardware

Which type of software translates a high-level language program into machine code one complete program at a time before execution?

  1. An interpreter
  2. An assembler
  3. A linker
  4. A compiler Correct answer.

Explanation

A compiler reads the whole source program and produces a complete machine-code object file before the program runs. An interpreter instead translates and executes statement by statement, an assembler handles low-level assembly mnemonics, and a linker joins object modules. Whole-program translation is the defining feature of a compiler.

Question 10Computer Fundamentals and Hardware

Which cache memory level is normally the smallest and fastest, sitting closest to the processor core?

  1. L3 cache
  2. Main memory
  3. L2 cache
  4. L1 cache Correct answer.

Explanation

Cache levels are arranged in a hierarchy in which smaller, faster memory sits nearer the core. L1 is the smallest and fastest level, L2 is larger and slower, and L3 is shared and slower still. Main memory lies outside the cache hierarchy altogether.

Question 11Computer Fundamentals and Hardware

A computer has 12-bit memory addresses. How many distinct memory locations can it directly address?

  1. 4096 Correct answer.
  2. 1024
  3. 2048
  4. 144

Explanation

The number of addressable locations equals two raised to the power of the number of address bits. For 12 bits this is two to the twelfth power, which equals 4096. The other values arise from squaring the bit count or from using ten or eleven bits instead.

Question 12Computer Fundamentals and Hardware

Which logic gate produces a HIGH output only when all of its inputs are HIGH?

  1. AND gate Correct answer.
  2. OR gate
  3. XOR gate
  4. NOR gate

Explanation

An AND gate outputs 1 only when every input is 1; a single low input forces the output low. An OR gate outputs 1 when any input is 1, an XOR gate when the inputs differ, and a NOR gate is the inverse of OR. The all-inputs-high condition is unique to AND.

Question 13Computer Fundamentals and Hardware

Which of the following best describes the function of the control unit within a processor?

  1. It directs the operation of the other units by decoding instructions and issuing control signals. Correct answer.
  2. It converts analogue signals into digital form.
  3. It stores recently used data for quick retrieval.
  4. It performs arithmetic operations on data.

Explanation

The control unit decodes each instruction and generates the timing and control signals that coordinate the arithmetic, logic and memory units. Arithmetic itself is performed by the ALU, caching is handled by cache memory, and analogue conversion is done by dedicated converters. Coordination rather than computation is the control unit's role.

Question 14Computer Fundamentals and Hardware

What is the primary purpose of a computer bus?

  1. To cool the processor during heavy workloads
  2. To convert alternating current into direct current
  3. To store the operating system permanently
  4. To transfer data and control signals between components Correct answer.

Explanation

A bus is a shared set of electrical pathways that carries data, addresses and control signals between the processor, memory and peripherals. Its width and clock rate strongly influence overall system performance. Cooling, permanent storage and power conversion are handled by entirely separate subsystems.

Question 15Computer Fundamentals and Hardware

Which statement correctly distinguishes RAM from ROM?

  1. RAM is read-only during normal operation, while ROM can be freely rewritten by programs.
  2. RAM holds data temporarily and is writable, while ROM retains fixed data and is normally read-only. Correct answer.
  3. RAM is non-volatile and holds firmware, while ROM is volatile and holds user files.
  4. RAM is slower than ROM and is used only for backup storage.

Explanation

RAM is volatile working memory that programs can read and write during execution, losing its contents at power-off. ROM is non-volatile and holds permanent data such as firmware, which normal programs cannot overwrite. The distinction combines volatility with write access.

Question 16Computer Fundamentals and Hardware

Using two's complement representation with 8 bits, what is the result of adding 0110 1101 and 1001 0011?

  1. 0000 0000 with a carry out of 1 Correct answer.
  2. 1111 1111 with a carry out of 1
  3. 1000 0000 with no carry
  4. 0000 0001 with no carry

Explanation

Adding the two patterns bit by bit gives 1 0000 0000, so the 8-bit result is all zeros and a carry leaves the most significant bit. In two's complement the operands represent 109 and negative 109, whose sum is zero. The discarded carry is expected and does not indicate overflow.

Question 17Computer Fundamentals and Hardware

A processor's clock runs at 2 GHz and a given instruction requires an average of 4 clock cycles. What is the approximate average time to execute one such instruction?

  1. 8 nanoseconds
  2. 0.5 nanoseconds
  3. 4 nanoseconds
  4. 2 nanoseconds Correct answer.

Explanation

At 2 GHz the clock period is one divided by two billion seconds, which is 0.5 nanoseconds. Four cycles therefore take four times 0.5, giving 2 nanoseconds per instruction. The other values confuse the clock period with the total cycle count.

Question 18Computer Fundamentals and Hardware

Which statement about von Neumann architecture is correct?

  1. Programs and data share the same memory and are carried over the same bus. Correct answer.
  2. Only data is stored in memory, while instructions are held in the control unit permanently.
  3. The processor executes data values directly without fetching instructions.
  4. Instructions and data are stored in separate memories with independent buses.

Explanation

In von Neumann architecture a single memory holds both instructions and data, and both travel over the same bus, which gives rise to the von Neumann bottleneck. Separate instruction and data memories describe Harvard architecture instead. The stored-program concept is central to the von Neumann model.

Question 19Computer Fundamentals and Hardware

A system uses 16-bit addresses and each addressable unit is one byte. What is the maximum directly addressable memory size?

  1. 128 kilobytes
  2. 16 kilobytes
  3. 64 kilobytes Correct answer.
  4. 32 kilobytes

Explanation

Sixteen address bits give two to the sixteenth power, which is 65536 distinct addresses. With one byte per address that is 65536 bytes, equal to 64 kilobytes. The other options correspond to 15, 14 or 17 address bits.

Question 20Computer Fundamentals and Hardware

A hard disk drive stores data on rotating platters. Which statement correctly describes how the drive locates a specific block of data?

  1. The head reads every sector on the platter in order until it finds the requested block, then stops.
  2. The read/write head moves to the correct track, and the platter rotates until the correct sector arrives under the head. Correct answer.
  3. The controller jumps directly to the block address in memory and copies it without any mechanical movement.
  4. The platter stays still while the head scans radially across the surface to read the block.

Explanation

A hard disk is a mechanical device: the arm actuator positions the read/write head over the required track, and rotational latency is the wait for the target sector to pass beneath the head. Access time is therefore the sum of seek time, rotational latency and transfer time. Because both seek and rotation involve physical movement, HDD access is far slower than solid-state memory.

Question 21Operating Systems and System Software

Which component of an operating system is responsible for deciding which process runs on the CPU next?

  1. The scheduler Correct answer.
  2. The device driver
  3. The bootloader
  4. The file system

Explanation

The scheduler is the kernel subsystem that selects a ready process or thread and assigns it to a processor, balancing responsiveness and throughput. Device drivers translate kernel requests into hardware commands, and the file system manages stored data. The bootloader only loads the kernel at startup.

Question 22Operating Systems and System Software

A process is currently waiting for a disk read to complete. Which state is it in?

  1. Blocked Correct answer.
  2. Terminated
  3. Running
  4. Ready

Explanation

A process that cannot proceed until an external event such as I/O completion occurs is in the blocked (waiting) state. In the ready state it could run but lacks a CPU, and in the running state it is actually executing. Terminated means execution has finished permanently.

Question 23Operating Systems and System Software

Which memory allocation strategy gives a process a fixed-size partition chosen at load time, causing internal fragmentation?

  1. Paging
  2. Fixed partitioning Correct answer.
  3. Segmentation
  4. Dynamic partitioning

Explanation

Fixed partitioning divides memory into pre-set blocks; a process smaller than its block leaves unused space inside the block, which is internal fragmentation. Dynamic partitioning sizes blocks to the process, producing external fragmentation instead. Paging and segmentation are non-contiguous schemes.

Question 24Operating Systems and System Software

What is the primary purpose of a file system's directory structure?

  1. To organise files and support name-based lookup Correct answer.
  2. To schedule processes for execution
  3. To encrypt user passwords
  4. To compress file contents on disk

Explanation

Directories provide a hierarchical namespace that maps human-readable names to file metadata and storage locations. They do not perform compression, credential storage, or CPU scheduling, which belong to other subsystems. This naming function is what lets users and programs locate files without knowing physical addresses.

Question 25Operating Systems and System Software

Which of the following is an example of system software rather than application software?

  1. A spreadsheet program
  2. A web browser
  3. A photo editor
  4. A device driver Correct answer.

Explanation

System software manages hardware and provides a platform for other programs; device drivers are kernel-level components that control hardware, so they belong to this category. Spreadsheets, browsers, and photo editors are application software that users run to perform tasks.

Question 26Operating Systems and System Software

In a system using round-robin scheduling with a time quantum of 4 ms, three processes P1, P2 and P3 all arrive at time 0 and each needs 4 ms of CPU. In what order do they complete?

  1. P2, then P3, then P1
  2. All three complete simultaneously
  3. P3, then P2, then P1
  4. P1, then P2, then P3 Correct answer.

Explanation

Round-robin serves the ready queue in arrival order, giving each process one quantum. Since every process needs exactly one quantum, they finish in the order they are first dispatched: P1, P2, P3. No preemption occurs mid-quantum because each finishes within its allotted 4 ms.

Question 27Operating Systems and System Software

A system uses paging with a page size of 1 KB. A logical address 2500 is generated. What are the page number and offset?

  1. Page 2, offset 452 Correct answer.
  2. Page 2, offset 1476
  3. Page 1, offset 452
  4. Page 1, offset 1476

Explanation

With 1 KB (1024-byte) pages, the page number is the address divided by 1024 and the offset is the remainder. 2500 divided by 1024 gives 2 with remainder 452, so the address lies on page 2 at offset 452. This split lets the memory management unit translate pages independently.

Question 28Operating Systems and System Software

Which condition must hold for a deadlock to occur among a set of processes?

  1. The system must have more processes than processors
  2. Processes must hold resources while waiting for others Correct answer.
  3. Resources must be preemptible at all times
  4. At least one process must be suspended by the user

Explanation

Hold-and-wait is one of the four Coffman conditions for deadlock: processes retain allocated resources while requesting additional ones. The other conditions are mutual exclusion, no preemption, and circular wait. Preemptible resources actually help break deadlocks rather than cause them.

Question 29Operating Systems and System Software

What is thrashing in a virtual memory system?

  1. A scheduling policy that starves low-priority processes
  2. An interrupt storm from a faulty device driver
  3. Excessive page faults causing the system to spend most time swapping Correct answer.
  4. A disk failure that corrupts the page table

Explanation

Thrashing occurs when the combined working sets of running processes exceed physical memory, so the system spends most of its time servicing page faults instead of executing instructions. Throughput collapses even though the CPU may appear busy. Reducing the degree of multiprogramming or adding memory relieves it.

Question 30Operating Systems and System Software

Which file allocation method stores a file as a linked list of disk blocks, allowing easy growth but poor random access?

  1. Inode-based extent allocation
  2. Indexed allocation
  3. Linked allocation Correct answer.
  4. Contiguous allocation

Explanation

Linked allocation places a pointer in each block to the next block, so files can grow without relocating existing data. However, reaching block n requires traversing n-1 pointers, which makes random access slow and seeks frequent. Contiguous and indexed schemes support direct access far better.

Question 31Operating Systems and System Software

A process issues a system call to read from a file. Which sequence best describes what happens?

  1. The scheduler immediately terminates the calling process
  2. The process directly executes disk controller commands in user mode
  3. A trap switches to kernel mode, the kernel performs the I/O, then returns to user mode Correct answer.
  4. The CPU halts until the user presses a key

Explanation

System calls are the controlled entry point into the kernel: a trap or software interrupt changes the privilege level, the kernel validates parameters and performs the operation, and control returns to user mode. User-mode code cannot issue privileged hardware instructions directly. This separation protects the system from faulty or malicious programs.

Question 32Operating Systems and System Software

Which statement best describes the role of the kernel in a monolithic operating system?

  1. It provides all core services in a single privileged address space Correct answer.
  2. It delegates all hardware control to user-level servers
  3. It runs as a user process alongside applications
  4. It only manages the boot process and then exits

Explanation

In a monolithic design, scheduling, memory management, file systems, and drivers all execute in one privileged kernel image. This gives fast internal calls but means a fault in any component can crash the whole system. Microkernels instead push services into user-space servers.

Question 33Operating Systems and System Software

A disk has a seek time of 5 ms and a rotational latency of 3 ms. Ignoring transfer time, what is the average time to service a random block request?

  1. 8 ms Correct answer.
  2. 15 ms
  3. 5 ms
  4. 3 ms

Explanation

Access time for a random block is the sum of the time to move the head to the correct track and the time for the platter to rotate the target sector under the head. Adding 5 ms and 3 ms gives 8 ms. Transfer time would add a small further amount but is excluded here.

Question 34Operating Systems and System Software

Two processes each need exclusive access to resources A and B. P1 holds A and requests B; P2 holds B and requests A. Which technique directly prevents this deadlock?

  1. Disabling interrupts permanently
  2. Adding more physical memory
  3. Imposing a global ordering on resource acquisition Correct answer.
  4. Increasing the time quantum of the scheduler

Explanation

A total ordering of resources forces every process to request A and B in the same sequence, which makes a circular wait impossible. This is a prevention technique that removes one of the four Coffman conditions. It is simple and effective but can reduce concurrency.

Question 35Operating Systems and System Software

A system uses the Least Recently Used page replacement policy with three frames. The reference string is 1, 2, 3, 1, 4, 1. How many page faults occur, counting the initial fills?

  1. 5
  2. 4 Correct answer.
  3. 6
  4. 3

Explanation

References 1, 2, 3 each fault while filling the frames. The next reference to 1 hits and refreshes its recency. Reference 4 faults and evicts 2, the least recently used page, and the final reference to 1 hits. That gives four faults in total.

Question 36Operating Systems and System Software

Why does a microkernel architecture often perform worse than a monolithic kernel for I/O-intensive workloads?

  1. It cannot support virtual memory
  2. It forbids the use of device drivers
  3. It requires frequent inter-process communication and context switches between user-space servers Correct answer.
  4. It runs all services inside a single address space

Explanation

In a microkernel, services such as file systems and drivers run as separate user-space processes, so each request involves message passing and mode switches. These overheads accumulate on I/O-heavy paths where many small operations occur. The design still supports virtual memory and drivers, but pays for isolation with extra communication cost.

Question 37Computer Networks and Data Communication

Which OSI layer is responsible for logical addressing and routing of packets between networks?

  1. Network layer Correct answer.
  2. Transport layer
  3. Data link layer
  4. Session layer

Explanation

The network layer handles logical addressing such as IP addresses and determines the path packets take across multiple networks. Routing decisions and fragmentation belong here, which is why routers operate primarily at this layer.

Question 38Computer Networks and Data Communication

A network administrator needs a device that forwards frames based only on MAC addresses within a single LAN. Which device fits this requirement?

  1. Repeater
  2. Gateway
  3. Router
  4. Layer 2 switch Correct answer.

Explanation

A Layer 2 switch builds a MAC address table and forwards frames to the specific port associated with the destination MAC address. This makes it a data link layer device that does not examine IP addresses.

Question 39Computer Networks and Data Communication

Which protocol operates at the transport layer and provides reliable, connection-oriented delivery with acknowledgements and retransmission?

  1. TCP Correct answer.
  2. UDP
  3. IP
  4. ICMP

Explanation

TCP establishes a connection through a three-way handshake and uses sequence numbers, acknowledgements, and retransmission to guarantee ordered delivery. UDP, by contrast, is connectionless and does not guarantee delivery.

Question 40Computer Networks and Data Communication

What is the primary purpose of DNS in an IP network?

  1. To route packets between autonomous systems
  2. To encrypt web traffic between client and server
  3. To resolve domain names into IP addresses Correct answer.
  4. To assign IP addresses dynamically to hosts

Explanation

DNS is a distributed hierarchical naming system that maps human-readable domain names to IP addresses so applications can locate servers. It works through recursive and iterative queries among name servers.

Question 41Computer Networks and Data Communication

Which classful IPv4 address range is reserved for private use according to RFC 1918 and is commonly used in home networks?

  1. 8.0.0.0 to 8.255.255.255
  2. 172.16.0.0 to 172.31.255.255 Correct answer.
  3. 169.254.0.0 to 169.254.255.255
  4. 224.0.0.0 to 239.255.255.255

Explanation

The RFC 1918 private ranges are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. The 172.16.0.0 to 172.31.255.255 block is the middle private range used in many organizational networks.

Question 42Computer Networks and Data Communication

Which transmission medium uses light pulses confined by total internal reflection and offers very high bandwidth immune to electromagnetic interference?

  1. Optical fibre Correct answer.
  2. Microwave link
  3. Coaxial cable
  4. Shielded twisted pair

Explanation

Optical fibre carries data as light pulses guided through a glass or plastic core by total internal reflection. Because the signal is optical rather than electrical, it is immune to electromagnetic interference and supports very high bandwidth over long distances.

Question 43Computer Networks and Data Communication

In the TCP/IP model, which layer corresponds most closely to the OSI data link and physical layers combined?

  1. Application layer
  2. Transport layer
  3. Network access layer Correct answer.
  4. Internet layer

Explanation

The TCP/IP network access layer, sometimes called the link layer, covers both framing and physical transmission, absorbing the duties of the OSI data link and physical layers. This four-layer model simplifies the seven-layer OSI reference model.

Question 44Computer Networks and Data Communication

A subnet mask of 255.255.255.192 is applied to a network. How many usable host addresses does each resulting subnet provide?

  1. 64
  2. 30
  3. 62 Correct answer.
  4. 126

Explanation

The mask 255.255.255.192 leaves six host bits because 192 in binary is 11000000, giving 2^6 = 64 total addresses per subnet. Subtracting the network and broadcast addresses leaves 62 usable host addresses.

Question 45Computer Networks and Data Communication

A host with IP address 192.168.10.130 and mask 255.255.255.192 needs to send data to 192.168.10.190. What does the host conclude about the destination?

  1. The destination address is a broadcast address
  2. The destination is on the same subnet, so the frame is sent directly
  3. The destination is on a different subnet, so the frame is sent to the default gateway Correct answer.
  4. The destination address is invalid and the packet is dropped

Explanation

With a /26 mask the subnet boundaries step by 64, so the source lies in 192.168.10.128/26 (range 128 to 191) and the destination 190 also falls inside that same block. Since both addresses share the 192.168.10.128/26 network, the host actually treats the destination as local and would resolve its MAC address with ARP rather than forwarding to the gateway.

Question 46Computer Networks and Data Communication

Which statement correctly describes the difference between a collision domain and a broadcast domain?

  1. A collision domain is bounded by routers, while a broadcast domain is bounded by switches
  2. A broadcast domain is limited to two devices, while a collision domain can include many
  3. A collision domain contains devices whose frames can collide, while a broadcast domain contains devices that receive the same broadcast frames Correct answer.
  4. Both domains are always identical in a switched network

Explanation

A collision domain is the set of devices sharing a medium where frames can collide, and each switch port forms its own collision domain. A broadcast domain is the set of devices that receive a broadcast frame, and switches forward broadcasts to all ports unless VLANs or routers separate them.

Question 47Computer Networks and Data Communication

Which routing approach uses manually configured entries that do not adapt automatically to topology changes?

  1. Dynamic routing
  2. Distance-vector routing
  3. Link-state routing
  4. Static routing Correct answer.

Explanation

Static routes are entered by an administrator and remain fixed until changed manually, so they do not react to link failures. Dynamic protocols such as link-state and distance-vector algorithms exchange information to recompute paths automatically.

Question 48Computer Networks and Data Communication

In a distance-vector routing protocol, what is the counting-to-infinity problem primarily caused by?

  1. Incompatible subnet masks between neighbours
  2. Excessive bandwidth consumption from hello packets
  3. Slow convergence when routers propagate incorrect distance values after a link failure Correct answer.
  4. Duplicate IP addresses on the same segment

Explanation

When a link fails, neighbours may keep advertising stale distances and gradually increment them, causing routers to believe a longer path still exists. This slow convergence lets distance values climb toward infinity, and techniques such as split horizon and route poisoning are used to limit it.

Question 49Computer Networks and Data Communication

Which mechanism does NAT provide in a typical small office network?

  1. It guarantees delivery of packets across the internet
  2. It encrypts packets between the LAN and the internet
  3. It assigns MAC addresses to newly connected devices
  4. It allows many private hosts to share one public IP address Correct answer.

Explanation

Network address translation rewrites private source addresses and ports to a single public address, letting multiple internal hosts share one registered IP. It conserves public IPv4 space but does not itself provide security or reliability.

Question 50Computer Networks and Data Communication

A technician captures traffic and observes that the TCP three-way handshake completes, but data segments are repeatedly retransmitted. Which condition best explains this behaviour?

  1. Packet loss on the path is causing missing acknowledgements Correct answer.
  2. The switch has disabled spanning tree
  3. The DNS server returned an incorrect record
  4. The ARP cache has been cleared on the client

Explanation

Retransmissions after a successful handshake indicate that segments or their acknowledgements are being lost, so TCP resends them after the retransmission timeout or on duplicate ACKs. Path congestion or link errors are common causes of this loss.