A forensic analyst has a .pcap file that was captured on a network with a VLAN. The analyst needs to determine which VLAN a particular host was on. What is the most reliable way to find this in Wireshark?

Open the file and use the 'Telephony > VLAN' menu.

Look for the 802.1Q VLAN ID field in the Ethernet header of the packets.

Check the IP address of the host and infer the VLAN from the subnet.

Use the 'Statistics > VLAN' menu to see all VLANs.

You are about to capture traffic for a legal investigation and need to ensure the capture is not accidentally overwritten. What should you do?

Use a display filter to reduce the packets shown

Save the capture only after stopping it

Leave the capture running indefinitely

Use multiple files with a size limit and stop after the capture is complete

A user reports slow internet access. The admin suspects excessive broadcast traffic on the LAN. To confirm, the admin wants to capture traffic on the user's PC. Which interface should the admin select in Wireshark?

The Ethernet or Wi-Fi interface that connects to the LAN.

Any interface because Wireshark captures all interfaces simultaneously.

The virtual adapter created by VPN software.

The loopback interface to see local broadcasts.

You have a .pcap file from a network where the IP addresses were assigned by DHCP. You need to analyze a specific TCP conversation, but the client IP is not known. What is the most efficient way to find the conversation?

Use Statistics > Conversations to see all TCP conversations and identify the one of interest

Use the Find Packet feature to search for a specific TCP port

Apply a display filter for DHCP to find the IP assignment first

Scroll through the entire packet list manually

What is the primary purpose of using a packet analyzer like Wireshark in network troubleshooting?

To measure the bandwidth utilization of a network link

To configure the IP address of a network interface

To capture and examine the contents of network packets

To test the reachability of a remote host

CiscoCertified Support Technician (CCST) Networking

Domain 5Objective 2

5.2. Perform a Packet Capture with Wireshark and Save It to a File. 100-150 Practice Questions (Page 1)

Part of the Diagnosing Problems domain, which makes up ~21% of our current practice bank. Cisco does not publish an official question count, but from its 50-minute exam (~20–35 total, ~4–7 in this domain), expect 1–1 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

4concepts

Questions 1–5

1expert · medium
A forensic analyst has a .pcap file that was captured on a network with a VLAN. The analyst needs to determine which VLAN a particular host was on. What is the most reliable way to find this in Wireshark?
Select an answer first
2application · medium
You are about to capture traffic for a legal investigation and need to ensure the capture is not accidentally overwritten. What should you do?
Select an answer first
3application · easy
A user reports slow internet access. The admin suspects excessive broadcast traffic on the LAN. To confirm, the admin wants to capture traffic on the user's PC. Which interface should the admin select in Wireshark?
Select an answer first
4expert · hard
You have a .pcap file from a network where the IP addresses were assigned by DHCP. You need to analyze a specific TCP conversation, but the client IP is not known. What is the most efficient way to find the conversation?
Select an answer first
5foundation · easy
What is the primary purpose of using a packet analyzer like Wireshark in network troubleshooting?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 100-150

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “100-150” is a trademark of its owner, used for identification only.