A network admin suspects a rogue DHCP server is assigning incorrect IP addresses. To confirm, they need to see DHCP packets on the LAN. What is the best approach?

Capture on a workstation's interface and filter for DHCP (udp.port == 67 or 68)

Capture on the router's WAN interface

Open a saved .pcap file from a different network

Use a display filter for HTTP to see DHCP

When Wireshark opens a .pcap file, what does the main window display?

The network interfaces available for capture

A prompt to start a new live capture

The list of captured packets from that file

A technician wants to capture traffic on a wireless interface using Wireshark. After starting Wireshark, what must the technician do to begin the capture?

Use the 'Capture' menu and select 'Restart'

Type 'capture start' in the display filter bar

Select the wireless interface from the interface list and click the start button

Click the 'Open' button and select a .pcap file

A network team is troubleshooting an application that uses a proprietary protocol on a non-standard TCP port. The application is slow, and the team suspects the protocol is not being handled correctly by a firewall. What is the best way to use Wireshark to confirm this?

Open a previously saved capture from the firewall to see the traffic.

Capture traffic on the client and server, then compare the packet flows to see if the firewall is modifying or dropping packets.

Capture traffic only on the client to see if the application sends packets.

Use Wireshark to generate test packets to the server to see if they pass the firewall.

A technician receives a .pcap file from a remote site and needs to determine whether any DNS queries were sent to an unauthorized server. What is the most efficient first step in Wireshark?

Save the file as a .txt file and search for 'DNS' in a text editor.

Use the 'Statistics > Conversations' menu to see all IP addresses.

Start a new capture on the local interface to compare traffic.

Open the .pcap file and apply a DNS display filter.

CiscoCertified Support Technician (CCST) Networking

Domain 5Objective 2

5.2. Perform a Packet Capture with Wireshark and Save It to a File. 100-150 Practice Questions (Page 5)

Part of the Diagnosing Problems domain, which makes up ~21% of our current practice bank. Cisco does not publish an official question count, but from its 50-minute exam (~20–35 total, ~4–7 in this domain), expect 1–1 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

4concepts

Questions 21–25

21application · medium
A network admin suspects a rogue DHCP server is assigning incorrect IP addresses. To confirm, they need to see DHCP packets on the LAN. What is the best approach?
Select an answer first
22foundation · easy
When Wireshark opens a .pcap file, what does the main window display?
Select an answer first
23foundation · easy
A technician wants to capture traffic on a wireless interface using Wireshark. After starting Wireshark, what must the technician do to begin the capture?
Select an answer first
24expert · hard
A network team is troubleshooting an application that uses a proprietary protocol on a non-standard TCP port. The application is slow, and the team suspects the protocol is not being handled correctly by a firewall. What is the best way to use Wireshark to confirm this?
Select an answer first
25application · medium
A technician receives a .pcap file from a remote site and needs to determine whether any DNS queries were sent to an unauthorized server. What is the most efficient first step in Wireshark?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 100-150

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “100-150” is a trademark of its owner, used for identification only.