A script that automates network analysis

A file format that stores captured network packets for later analysis

A configuration file that defines firewall rules

A log file that records system events

An analyst follows a TCP stream in Wireshark and the data appears as readable ASCII text with occasional binary characters. The analyst needs to extract the data for further analysis. What is the best approach?

Use Export Objects > HTTP to save the data.

Copy the text from the Follow TCP Stream dialog and paste it into a text file.

Save the stream as Raw and then use a hex editor or appropriate tool to handle the mixed binary and text data.

Change the stream direction to 'Entire conversation' and save as ASCII.

An analyst has followed a TCP stream in Wireshark and identified that it contains a file transfer. The analyst needs to save the raw data of the stream to a file for further analysis. Which action should the analyst take?

In the Follow TCP Stream dialog, select 'Raw' from the 'Show and save data as' dropdown and click 'Save as'.

Select all packets in the stream and use 'File' > 'Export Specified Packets'.

Copy the data from the dialog and paste it into a new file using a text editor.

Use the 'File' > 'Export Packet Dissections' menu to save the stream data.

How can you quickly identify all packets that belong to the same TCP connection in Wireshark?

By selecting a packet and pressing the 'Follow TCP Stream' button

By using the Statistics menu to view packet lengths

By sorting the packet list by the protocol column

By applying a display filter using the tcp.stream field

An analyst is working with a PCAP that contains multiple TCP streams. The analyst needs to identify which stream contains a specific file transfer. What is the most efficient way to find the correct stream?

Use the display filter 'http' and look for a file download.

Use the display filter 'tcp.stream eq 0' and check the data.

Use the menu Statistics > Conversations and look for the conversation with the largest data transfer.

Use the menu Telephony > VoIP Calls and look for a call with data.

CiscoCertified CyberOps Associate

Domain 4Objective 6

4.6 Extract Files from a TCP Stream When Given a PCAP File and Wireshark 200-201 Practice Questions (Page 2)

Part of the 4.0 Network Intrusion Analysis domain, which accounts for 20% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

8concepts

20%of the exam

Questions 6–10

6foundation · easy
What is a PCAP file?
Select an answer first
7application · medium
An analyst follows a TCP stream in Wireshark and the data appears as readable ASCII text with occasional binary characters. The analyst needs to extract the data for further analysis. What is the best approach?
Select an answer first
8application · medium
An analyst has followed a TCP stream in Wireshark and identified that it contains a file transfer. The analyst needs to save the raw data of the stream to a file for further analysis. Which action should the analyst take?
Select an answer first
9foundation · easy
How can you quickly identify all packets that belong to the same TCP connection in Wireshark?
Select an answer first
10application · medium
An analyst is working with a PCAP that contains multiple TCP streams. The analyst needs to identify which stream contains a specific file transfer. What is the most efficient way to find the correct stream?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.