5.2. Perform a Packet Capture with Wireshark and Save It to a File. 100-150 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   A technician has received a .pcap file from a colleague and wants to review the captured packets in Wireshark. What is the correct way to open this file?

   • AUse File > Open and select the .pcap file
   • BDrag the .pcap file into the display filter bar
   • CUse Capture > Start and select the .pcap file
   • DUse File > Export Packet Dissections
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security team needs to capture traffic on a production server that handles sensitive customer data. The capture must be saved for potential legal evidence, but the server has limited disk space. The team also needs to ensure the capture is not accidentally overwritten. What is the best approach?

   • ACapture all traffic and save to the system disk without any size limit.
   • BUse a display filter to reduce the amount of data saved.
   • CStart the capture and let it run indefinitely, then save the file after a week.
   • DUse a capture filter to limit traffic, save to a dedicated disk with a large file size limit, and use a ring buffer to avoid overwriting until the capture is stopped.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A technician is troubleshooting a connectivity issue and wants to see if the client is sending TCP SYN packets. What is the most direct way to verify this?

   • AUse ping to test connectivity
   • BCheck the ARP cache on the client
   • CStart a Wireshark capture on the client and look for packets with the SYN flag set
   • DReview the Windows event log
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An admin is about to start a Wireshark capture on a busy network link. The admin wants to avoid capturing unnecessary traffic and also wants to save the capture to a file for later analysis. What should the admin do?

   • AStart the capture without any filter and save the file as .pcap while capturing.
   • BUse a display filter instead of a capture filter to reduce the file size.
   • CCapture on the loopback interface to avoid network traffic and then save the file.
   • DSet a capture filter to limit traffic, start the capture, and then save the file as .pcap after stopping.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   An analyst is reviewing a .pcap file that contains both encrypted and unencrypted traffic. The analyst needs to determine whether a user visited a specific website. The website uses HTTPS. What is the most reliable way to identify the visit?

   • ADecrypt the HTTPS traffic using the server's private key, which is usually available in the capture.
   • BUse the 'Statistics > HTTP' menu to see all website visits.
   • CLook for the TLS Server Name Indication (SNI) in the ClientHello packets to see the domain name.
   • DSearch for the website's IP address in the capture and assume it was visited.
   Reveal Solution Discussion Select an answer first