GIAC Certified Intrusion Analyst
Domain 2Objective 4
Wireshark Fundamentals GCIA Practice Questions (Page 6)
Part of the Traffic Analysis and Tools domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~26–43 in this domain), expect 7–11 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)
38questions here
8free pages
8concepts
Questions 26–30
- 26
An analyst is looking at a packet in Wireshark and sees that the packet details pane shows an Ethernet II header, an IPv4 header, a TCP header, and an HTTP header. The analyst wants to determine the source MAC address of the packet. Which pane should they look at?
Select an answer first - 27
In the Wireshark main window, which pane displays the raw bytes of the selected packet in both hexadecimal and ASCII representation?
Select an answer first - 28
Which Wireshark statistics tool would you use to see the total number of packets sent and received by each unique IP address in the capture?
Select an answer first - 29
An analyst is investigating a data exfiltration incident where a large file was transferred over HTTP in multiple TCP streams. The analyst needs to reconstruct the original file from the capture. The capture contains many HTTP requests and responses, and the file was split across multiple TCP connections. Which approach should be used?
Select an answer first - 30
When examining an HTTP packet in the packet details pane, where would you find the HTTP request method (e.g., GET, POST)?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIA” is a trademark of its owner, used for identification only.