What is the first step in carving an embedded file from a TCP stream?

Convert the stream to ASCII text

Identify the file signature (magic bytes) in the stream data

Save the entire stream as a raw file

Apply a display filter to show only the first packet

During analysis of a TCP stream, an analyst notices the data contains a ZIP file signature (PK) but the stream also includes HTTP headers and other protocol overhead. What is the most effective way to extract the ZIP file?

Change the stream direction to 'Client to Server' and save as raw.

Save the entire stream as Raw, then use a file carving tool or manually trim the bytes before and after the ZIP signature.

Use Export Objects > HTTP and select the ZIP file from the list.

Copy the visible text from the Follow TCP Stream dialog and save it as a .zip file.

In Wireshark, how do you open the 'Follow TCP Stream' window for a selected packet?

Use the 'File' menu and select 'Export Packet Dissections'

Click the 'Decode As' button in the toolbar

Right-click the packet and select 'Follow' > 'TCP Stream'

Go to the Capture menu and choose 'Start'

How can you quickly determine whether a TCP stream contains binary data or text in Wireshark's Follow TCP Stream window?

By switching the display format between ASCII, Hex Dump, and Raw and observing the content

By looking at the source and destination IP addresses

By counting the number of packets in the stream

By checking the packet length column in the packet list

After extracting a file from a TCP stream, what is a good way to verify that the file is intact?

Open the file in a text editor to see if it looks readable

Check that the file size is a multiple of 4 bytes

Compare its hash value to a known hash of the original file

Verify that the file was saved with a .txt extension

CiscoCertified CyberOps Associate

Domain 4Objective 6

4.6 Extract Files from a TCP Stream When Given a PCAP File and Wireshark 200-201 Practice Questions (Page 3)

Part of the 4.0 Network Intrusion Analysis domain, which accounts for 20% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

8concepts

20%of the exam

Questions 11–15

11foundation · easy
What is the first step in carving an embedded file from a TCP stream?
Select an answer first
12application · medium
During analysis of a TCP stream, an analyst notices the data contains a ZIP file signature (PK) but the stream also includes HTTP headers and other protocol overhead. What is the most effective way to extract the ZIP file?
Select an answer first
13foundation · easy
In Wireshark, how do you open the 'Follow TCP Stream' window for a selected packet?
Select an answer first
14foundation · easy
How can you quickly determine whether a TCP stream contains binary data or text in Wireshark's Follow TCP Stream window?
Select an answer first
15foundation · easy
After extracting a file from a TCP stream, what is a good way to verify that the file is intact?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.