An analyst is using Wireshark to analyze a capture and notices that the packet list shows a column for 'Info' that is not displaying the expected protocol information. The analyst wants to customize the packet list to show the source and destination ports in separate columns. What is the most efficient way to do this?

Use Statistics > Endpoints to view ports.

Use the Display Filter bar to add columns for ports.

Use the Packet Details pane to view ports for each packet.

Right-click a column header and select 'Column Preferences' to add new columns for source and destination ports.

An analyst is using Wireshark and wants to see the time between packets in a capture. The analyst wants the Time column to display the time since the beginning of the capture. Which setting should be changed?

View > Time Display Format > Seconds Since Beginning of Capture

Capture > Options > Time Format

Edit > Preferences > Appearance > Columns

A security team needs to capture traffic on a busy network segment to analyze only web traffic to a specific server. They want to minimize the capture file size and avoid capturing unrelated traffic. Which approach should they use?

Set a display filter before starting the capture

Capture all traffic and apply a display filter later

Use the IO Graph to filter traffic during capture

Set a capture filter to tcp port 80 and host 192.168.1.10

GIAC Certified Intrusion Analyst

Domain 2Objective 4

Wireshark Fundamentals GCIA Practice Questions (Page 3)

Part of the Traffic Analysis and Tools domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~26–43 in this domain), expect 7–11 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

8concepts

Questions 11–15

11foundation · easy
Which Wireshark feature allows you to extract files (e.g., images, documents) that were transferred over HTTP from a capture?
Select an answer first
12expert · hard
An analyst is using Wireshark to analyze a capture and notices that the packet list shows a column for 'Info' that is not displaying the expected protocol information. The analyst wants to customize the packet list to show the source and destination ports in separate columns. What is the most efficient way to do this?
Select an answer first
13application · medium
An analyst is using Wireshark and wants to see the time between packets in a capture. The analyst wants the Time column to display the time since the beginning of the capture. Which setting should be changed?
Select an answer first
14application · medium
A security team needs to capture traffic on a busy network segment to analyze only web traffic to a specific server. They want to minimize the capture file size and avoid capturing unrelated traffic. Which approach should they use?
Select an answer first
15foundation · easy
Which Wireshark main window component provides quick access to common actions such as starting a capture, stopping a capture, and opening a capture file?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIA” is a trademark of its owner, used for identification only.

Wireshark Fundamentals GCIA Practice Questions (Page 3)

Questions 11–15

Which Wireshark feature allows you to extract files (e.g., images, documents) that were transferred over HTTP from a capture?

An analyst is using Wireshark and wants to see the time between packets in a capture. The analyst wants the Time column to display the time since the beginning of the capture. Which setting should be changed?

A security team needs to capture traffic on a busy network segment to analyze only web traffic to a specific server. They want to minimize the capture file size and avoid capturing unrelated traffic. Which approach should they use?

Which Wireshark main window component provides quick access to common actions such as starting a capture, stopping a capture, and opening a capture file?

Keep studying — Traffic Analysis and Tools