L7
Application -- where users meet the network. HTTP, FTP, SMTP, DNS, and SSH all live here. Firewalls can inspect at this layer.
L6
Presentation -- translates, encrypts, and compresses data. SSL/TLS is the key exam protocol at this layer.
L5
Session -- manages dialogs between applications. NetBIOS and RPC are the most-tested protocols here.
L4
Transport -- TCP for reliability (handshake, guaranteed delivery), UDP for speed (connectionless, no overhead). Port numbers live here.
L3
Network -- IP addressing and routing. Routers and Layer 3 switches operate here. Can't reach a remote subnet? Start at Layer 3.
L2
Data Link -- MAC addresses, switches, frames, and VLANs. ARP bridges Layer 3 logical addressing to Layer 2 physical addressing.
L1
Physical -- bits on the wire. Dead LEDs, bad cables, failed NICs. Always check physical layer first in any troubleshooting scenario.