2.23 Evaluate Artifacts and Streams in a Packet Capture File 350-201 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which Wireshark feature allows you to view the raw bytes of a selected packet in both hexadecimal and ASCII representation?

   • APacket Bytes pane
   • BCapture Options dialog
   • CPacket List pane
   • DPacket Details pane
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   When dissecting a DNS packet in Wireshark, which field indicates the number of questions in the DNS query?

   • ANSCOUNT
   • BQDCOUNT
   • CARCOUNT
   • DANCOUNT
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   You have a large pcapng file and need to focus on a single conversation between two IP addresses over port 445. Which Wireshark display filter shows only that TCP conversation?

   • Aip.src == 10.1.1.1 && ip.dst == 10.2.2.2 && tcp.dstport == 445
   • Btcp.stream eq 0
   • Chttp && ip.addr == 10.1.1.1
   • Dip.addr == 10.1.1.1 && ip.addr == 10.2.2.2 && tcp.port == 445
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which Wireshark display filter would you use to show only packets that use TCP port 443?

   • Atcp.dstport == 443
   • Btcp.port == 443
   • Ctcp.port == 443 and tcp.port == 443
   • Dtcp.srcport == 443
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   You have two capture files: one in pcap format and one in pcapng format. You need to merge them into a single file for analysis. Which approach is most reliable?

   • AConvert the pcapng to pcap using tcpdump, then merge with a text editor.
   • BUse Wireshark's 'Merge' function, which supports both formats.
   • COpen both files and manually copy packets from one to the other.
   • DUse a hex editor to concatenate the files.
   Reveal Solution Discussion Select an answer first