2.23 Evaluate Artifacts and Streams in a Packet Capture File 350-201 Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   When analyzing a packet capture, which type of artifact is commonly found in the payload of an HTTP POST request?

   • AARP cache entries
   • BUser credentials submitted via a web form
   • CEncrypted TLS session keys
   • DDNS resolution records
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   In a capture, you see an IP packet with a total length field smaller than the header length field indicates. What does this indicate?

   • AA valid IPv6 packet.
   • BA malformed or corrupted packet.
   • CA packet with an empty payload.
   • DA normal fragmented packet.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the primary purpose of TCP stream reassembly in packet analysis?

   • ATo reconstruct the original application-layer data from multiple TCP segments.
   • BTo decrypt encrypted TCP traffic.
   • CTo identify the source and destination IP addresses of a connection.
   • DTo filter out retransmitted packets from the capture.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the purpose of using a display filter in Wireshark?

   • ATo reduce the size of the capture file on disk.
   • BTo hide packets that do not match the filter criteria from the view.
   • CTo speed up the capture process.
   • DTo permanently remove unwanted packets from the capture file.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which field in the IPv4 header is used to prevent packets from looping indefinitely?

   • ATime to Live (TTL)
   • BHeader Checksum
   • CIdentification
   • DProtocol
   Reveal Solution Discussion Select an answer first