In a packet capture, you notice a series of TCP packets with the SYN flag set and the ACK flag clear, all from the same source IP to various destination ports on a single host. The destination host responds with RST packets. What does this pattern most likely indicate?

A normal TCP handshake for a single connection.

A port scan being performed against the destination host.

A TCP retransmission due to packet loss.

A security analyst is analyzing a pcap file and sees a packet with an IP header that has a protocol field value of 6. What does this indicate?

The packet carries UDP traffic.

The packet carries ICMP traffic.

The packet carries TCP traffic.

Which of the following is an example of a suspicious pattern that might indicate malicious activity in a packet capture?

A single HTTP GET request to a web server.

A DNS query for a common domain like 'example.com'.

An ARP request for the local gateway's MAC address.

A large number of TCP SYN packets sent to many different destination ports on the same host.

During a forensic analysis, an analyst extracts a file from an HTTP stream and notices that the file has a .exe extension but the magic bytes are 'MZ'. What should the analyst conclude?

The file is a text file with a misleading extension.

The file is likely a Windows executable.

The file is a PDF disguised as an executable.

Which Wireshark feature allows you to export files that were transferred over HTTP from a packet capture?

File > Export Packet Dissections

CiscoCertified Network Professional Cybersecurity (CBRCOR)

Domain 2Objective 23

2.23 Evaluate Artifacts and Streams in a Packet Capture File 350-201 Practice Questions (Page 5)

Part of the Techniques domain, which accounts for 30% of the 350-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 1–1 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

9concepts

30%of the exam

Questions 21–25

21application · medium
In a packet capture, you notice a series of TCP packets with the SYN flag set and the ACK flag clear, all from the same source IP to various destination ports on a single host. The destination host responds with RST packets. What does this pattern most likely indicate?
Select an answer first
22application · medium
A security analyst is analyzing a pcap file and sees a packet with an IP header that has a protocol field value of 6. What does this indicate?
Select an answer first
23foundation · easy
Which of the following is an example of a suspicious pattern that might indicate malicious activity in a packet capture?
Select an answer first
24application · medium
During a forensic analysis, an analyst extracts a file from an HTTP stream and notices that the file has a .exe extension but the magic bytes are 'MZ'. What should the analyst conclude?
Select an answer first
25foundation · easy
Which Wireshark feature allows you to export files that were transferred over HTTP from a packet capture?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 350-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “350-201” is a trademark of its owner, used for identification only.