5.2. Perform a Packet Capture with Wireshark and Save It to a File. 100-150 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A user reports intermittent web page load failures. You open Wireshark on the user's PC and need to capture traffic only while the problem occurs. The user will reproduce the issue in the next few minutes. What should you do first?

   • ASelect the active network interface and click the blue shark-fin icon to start capturing
   • BOpen a saved .pcap file from the user's previous session to analyze the past traffic
   • CStop the current capture and save the existing packets to a .pcap file
   • DApply a display filter for HTTP before starting the capture
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   After capturing packets in Wireshark, a technician wants to save the capture so it can be opened later in Wireshark. Which file format should be used?

   • A.txt
   • B.csv
   • C.pcap
   • D.exe
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   An admin is capturing traffic to diagnose a problem that occurs intermittently. The capture may run for several hours. What should the admin do to ensure the capture is saved without losing data if the system crashes?

   • AWait until the problem occurs and then start the capture.
   • BUse multiple capture files with a ring buffer and a size limit.
   • CSave the capture only after stopping it, hoping the system does not crash.
   • DUse a display filter to limit the capture to only the problem packets.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   You are troubleshooting slow DNS resolution. You start a Wireshark capture on the client's interface, reproduce the issue, and then stop the capture. What should you do next to preserve the evidence?

   • ASave the capture to a .pcap file
   • BClose Wireshark without saving
   • CApply a display filter and then close Wireshark
   • DClear the packet list and start a new capture
   Reveal Solution Discussion Select an answer first
6. 30application · easy

   A technician is capturing traffic on a wireless interface to troubleshoot a roaming issue. The technician wants to save the capture in a format that can be opened by other tools and also preserve the original timestamps. What should the technician do?

   • AExport the capture to a CSV file to keep timestamps.
   • BStop the capture and save the file as a .pcap file, which preserves timestamps and is widely supported.
   • CSave the file as a plain text file to preserve timestamps.
   • DTake a screenshot of the packet list to preserve the timestamps.
   Reveal Solution Discussion Select an answer first