4.6 Extract Files from a TCP Stream When Given a PCAP File and Wireshark 200-201 Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   An analyst has extracted a file from a TCP stream and wants to verify its integrity. The analyst has the original file's SHA-256 hash from the transfer metadata. The extracted file's hash does not match. What is the most likely cause?

   • AThe hash algorithm is wrong; the analyst should use MD5 instead.
   • BThe file was transferred over UDP, not TCP.
   • CThe file is encrypted and needs to be decrypted first.
   • DThe extracted file includes protocol framing data or was trimmed incorrectly during carving.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which of the following is a common file signature used to identify a PNG image?

   • A25 50 44 46
   • B50 4B 03 04
   • CFF D8 FF E0
   • D89 50 4E 47 0D 0A 1A 0A
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   An analyst is investigating a PCAP that contains a file transfer over a protocol that uses multiple TCP connections. The analyst needs to reassemble the file from the data across these connections. What should the analyst do?

   • AUse Wireshark's 'Follow TCP Stream' on one connection and assume it contains the entire file.
   • BFollow each TCP stream individually and manually combine the data from each stream.
   • CUse a protocol dissector if available, such as HTTP, to reassemble the file from the application layer.
   • DUse the 'Statistics' > 'Conversations' menu to view the data from all streams.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An analyst is examining a PCAP that contains a file transfer over a custom protocol. The analyst has followed the TCP stream and sees binary data. The analyst suspects the stream contains a ZIP archive. Which approach should the analyst use to extract the ZIP file?

   • AUse Wireshark's 'Export Objects' feature to extract the ZIP file.
   • BLook for the ZIP file signature in the packet bytes pane of the first packet and copy the bytes from that packet.
   • CSearch the raw stream for the ZIP local file header signature (PK\x03\x04) and save the bytes from that signature to the end of the central directory (PK\x05\x06).
   • DSave the entire raw stream to a file and rename it with a .zip extension.
   Reveal Solution Discussion Select an answer first
6. 30expert · medium

   An analyst is investigating a PCAP that contains multiple TCP streams. The analyst needs to extract a file that was transferred over a specific stream. The analyst has identified the stream number by looking at the 'TCP Stream' column in the packet list. Which Wireshark filter should the analyst apply to isolate that stream?

   • Aip.addr == 12
   • Btcp.port == 12
   • Cframe.number == 12
   • Dtcp.stream == 12
   Reveal Solution Discussion Select an answer first