An analyst is investigating a PCAP that contains multiple HTTP sessions. The analyst needs to isolate the TCP stream that carried a specific file download. The analyst knows the client IP address and the server IP address. Which Wireshark filter should the analyst apply to narrow down the packets to that specific TCP stream?

http.request && ip.addr == 192.168.1.10

ip.addr == 192.168.1.10 && ip.addr == 203.0.113.5

An analyst is following a TCP stream in Wireshark and sees a mix of readable text and binary characters. The analyst needs to extract the data for further analysis. What should the analyst do to determine whether the stream is primarily text or binary?

Save the stream as raw and run the 'strings' command on the saved file to see if it extracts readable strings.

Examine the packet bytes pane for the first packet in the stream to see if the payload contains non-printable characters.

Look at the 'Show and save data as' dropdown in the Follow TCP Stream dialog and select 'ASCII' to see if the data displays as readable text.

Use the 'Hex Dump' view in the Follow TCP Stream dialog and look for a high proportion of bytes outside the printable ASCII range (0x20-0x7E).

An analyst is investigating a PCAP and finds a TCP stream that contains a file transfer. The stream includes a file signature for a RAR archive, but the file is fragmented across multiple TCP segments. What is the best approach to extract the RAR file?

Copy the visible text from the Follow TCP Stream dialog and save it as a .rar file.

Use Export Objects > HTTP to save the RAR file.

Change the stream direction to 'Client to Server' and save as raw.

Use Follow TCP Stream to reassemble the stream, save as Raw, and then carve out the RAR file based on its signature.

CiscoCertified CyberOps Associate

Domain 4Objective 6

4.6 Extract Files from a TCP Stream When Given a PCAP File and Wireshark 200-201 Practice Questions (Page 1)

Part of the 4.0 Network Intrusion Analysis domain, which accounts for 20% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

8concepts

20%of the exam

Questions 1–5

1application · medium
An analyst is investigating a PCAP that contains multiple HTTP sessions. The analyst needs to isolate the TCP stream that carried a specific file download. The analyst knows the client IP address and the server IP address. Which Wireshark filter should the analyst apply to narrow down the packets to that specific TCP stream?
Select an answer first
2foundation · easy
Which Wireshark display filter would you use to show only packets belonging to a specific TCP stream, assuming the stream index is 5?
Select an answer first
3application · medium
An analyst is following a TCP stream in Wireshark and sees a mix of readable text and binary characters. The analyst needs to extract the data for further analysis. What should the analyst do to determine whether the stream is primarily text or binary?
Select an answer first
4expert · hard
An analyst is investigating a PCAP and finds a TCP stream that contains a file transfer. The stream includes a file signature for a RAR archive, but the file is fragmented across multiple TCP segments. What is the best approach to extract the RAR file?
Select an answer first
5application · easy
An analyst is investigating a PCAP and needs to view the full contents of a TCP conversation that includes a file transfer. The analyst wants to see the reassembled data in a single view. Which Wireshark feature should be used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.

4.6 Extract Files from a TCP Stream When Given a PCAP File and Wireshark 200-201 Practice Questions (Page 1)

Questions 1–5

Which Wireshark display filter would you use to show only packets belonging to a specific TCP stream, assuming the stream index is 5?

An analyst is following a TCP stream in Wireshark and sees a mix of readable text and binary characters. The analyst needs to extract the data for further analysis. What should the analyst do to determine whether the stream is primarily text or binary?

An analyst is investigating a PCAP and finds a TCP stream that contains a file transfer. The stream includes a file signature for a RAR archive, but the file is fragmented across multiple TCP segments. What is the best approach to extract the RAR file?

An analyst is investigating a PCAP and needs to view the full contents of a TCP conversation that includes a file transfer. The analyst wants to see the reassembled data in a single view. Which Wireshark feature should be used?

Keep studying — 4.0 Network Intrusion Analysis