A junior analyst opens a PCAP and sees a packet with an Ethernet header, an IPv4 header, and a TCP header. The analyst wants to find the destination IP address. Which field should they examine?

The destination address field in the IPv4 header

The destination MAC address in the Ethernet header

The protocol field in the IPv4 header

The destination port in the TCP header

An analyst is reviewing a PCAP and sees a packet with an Ethernet header, an IPv4 header with protocol field 6, and a TCP header with source port 443 and destination port 51234. What is the destination port number?

51234 and 443 are both destination ports

An analyst opens a PCAP in Wireshark and filters for traffic to a web server at 192.0.2.10. The first packet shows an Ethernet frame containing an IPv4 header with protocol field 6, followed by a TCP header with source port 49152 and destination port 443. The analyst needs to report the client address that initiated the connection. Which field should be used?

The destination IP address in the IPv4 header

The source port in the TCP header

The protocol field in the IPv4 header

The source IP address in the IPv4 header

CiscoCertified CyberOps Associate

Domain 4Objective 7

4.7 Identify Key Elements in an Intrusion from a Given PCAP File 200-201 Practice Questions (Page 5)

Part of the 4.0 Network Intrusion Analysis domain, which accounts for 20% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 1–2 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

7concepts

20%of the exam

Questions 21–25

21foundation · easy
In an IPv4 packet captured in a PCAP file, which header field indicates the destination IP address?
Select an answer first
22application · medium
A junior analyst opens a PCAP and sees a packet with an Ethernet header, an IPv4 header, and a TCP header. The analyst wants to find the destination IP address. Which field should they examine?
Select an answer first
23application · medium
An analyst is examining a PCAP and sees a TCP packet with destination port 25. The payload contains the string 'HELO mail.example.com'. Which application-layer protocol is being used?
Select an answer first
24application · medium
An analyst is reviewing a PCAP and sees a packet with an Ethernet header, an IPv4 header with protocol field 6, and a TCP header with source port 443 and destination port 51234. What is the destination port number?
Select an answer first
25application · medium
An analyst opens a PCAP in Wireshark and filters for traffic to a web server at 192.0.2.10. The first packet shows an Ethernet frame containing an IPv4 header with protocol field 6, followed by a TCP header with source port 49152 and destination port 443. The analyst needs to report the client address that initiated the connection. Which field should be used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.

4.7 Identify Key Elements in an Intrusion from a Given PCAP File 200-201 Practice Questions (Page 5)

Questions 21–25

In an IPv4 packet captured in a PCAP file, which header field indicates the destination IP address?

A junior analyst opens a PCAP and sees a packet with an Ethernet header, an IPv4 header, and a TCP header. The analyst wants to find the destination IP address. Which field should they examine?

An analyst is examining a PCAP and sees a TCP packet with destination port 25. The payload contains the string 'HELO mail.example.com'. Which application-layer protocol is being used?

An analyst is reviewing a PCAP and sees a packet with an Ethernet header, an IPv4 header with protocol field 6, and a TCP header with source port 443 and destination port 51234. What is the destination port number?

Keep studying — 4.0 Network Intrusion Analysis