2.23 Evaluate Artifacts and Streams in a Packet Capture File 350-201 Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   Which characteristic is unique to the pcapng format compared to the older pcap format?

   • AIt is a proprietary format used only by Cisco devices.
   • BIt uses a simpler header structure that reduces file size.
   • CIt is the only format that can be read by Wireshark.
   • DIt can store multiple interfaces and additional metadata blocks in a single file.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   While analyzing a pcapng file in Wireshark, you need to isolate only the packets that contain HTTP responses with a 500-series status code. Which display filter accomplishes this?

   • Ahttp.response.code >= 500
   • Btcp.port == 80
   • Chttp.status_code == 500
   • Dhttp.request.method == GET
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   In a packet capture, you see a UDP packet with a source port of 53 and a destination port of 53. The packet contains a DNS response with a large number of records. What is the most likely explanation?

   • AA DHCP request.
   • BA TCP handshake.
   • CA DNS amplification attack.
   • DA normal DNS query.
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   Which Wireshark feature automatically reassembles TCP streams for display?

   • AAnalyze > Decode As
   • BStatistics > Protocol Hierarchy
   • CCapture > Options
   • DFollow TCP Stream
   Reveal Solution Discussion Select an answer first
6. 50expert · hard

   You are investigating a pcap and need to find all packets that are part of a TCP conversation where the initial SYN packet had a window size of 65535. You have identified the SYN packet. What is the most efficient way to isolate the entire conversation?

   • AApply a display filter for tcp.window_size == 65535.
   • BSearch for the source IP and port in the packet list.
   • CRight-click the SYN packet and select 'Follow TCP Stream'.
   • DUse tcpdump with a filter for 'tcp[13] == 2'.
   Reveal Solution Discussion Select an answer first