Tcpdump Filters GCIA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which tcpdump filter matches packets that are NOT from host 10.0.0.1?

   • Anot src host 10.0.0.1
   • B!src host 10.0.0.1
   • Csrc host not 10.0.0.1
   • Dsrc host 10.0.0.1 not
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which tcpdump command correctly captures packets on interface eth0 and writes them to a file named capture.pcap?

   • Atcpdump -i eth0 -w capture.pcap
   • Btcpdump -i eth0 -r capture.pcap
   • Ctcpdump -c eth0 -w capture.pcap
   • Dtcpdump -w eth0 -i capture.pcap
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which tcpdump filter matches ICMP packets of type 8 (echo request)?

   • Aicmp[0] == 8
   • Bicmp type 8
   • Cicmp-type 8
   • Dicmp[icmptype] == 8
   Reveal Solution Discussion Select an answer first
5. 4foundation · medium

   In a tcpdump filter expression, which statement about parentheses and operator precedence is correct?

   • AParentheses override the default precedence, which evaluates 'and' before 'or'.
   • BParentheses are required around every primitive to form a valid filter expression.
   • CThe 'or' operator has higher precedence than 'and', so parentheses are needed to force 'and' to evaluate first.
   • DParentheses are ignored by tcpdump and only used for readability, not for changing evaluation order.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which tcpdump option increases the verbosity of the output?

   • A-q
   • B-v
   • C-e
   • D-d
   Reveal Solution Discussion Select an answer first