An analyst is about to start a capture on a multi-homed system and wants to capture traffic only on the interface connected to the internal network. The analyst also wants to save the capture to a file with a size limit. Which configuration steps are required?

Use the IO Graph to select the interface

Apply a display filter and then start capture

Use the Endpoints window to choose the interface

Select the correct interface in Capture Options and set a capture file size limit

What is the primary purpose of Wireshark's coloring rules?

To change the color of the Wireshark interface theme

To filter out unwanted packets from the display

To visually distinguish different packet types in the packet list

An analyst is analyzing a TCP conversation that contains a file transfer. The analyst wants to extract the exact data that was sent from the server to the client, excluding the client's acknowledgments and any retransmissions. What is the most effective method?

Use Statistics > Flow Graph to view the conversation.

Apply a display filter for tcp.flags.ack == 1 and export the filtered packets.

Follow the TCP stream and select the server-to-client direction in the stream content.

Use File > Export Objects > HTTP to extract the file.

GIAC Certified Intrusion Analyst

Domain 2Objective 4

Wireshark Fundamentals GCIA Practice Questions (Page 8)

Part of the Traffic Analysis and Tools domain, which makes up ~27% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~26–43 in this domain), expect 7–11 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

8concepts

Questions 36–38

36application · medium
An analyst is about to start a capture on a multi-homed system and wants to capture traffic only on the interface connected to the internal network. The analyst also wants to save the capture to a file with a size limit. Which configuration steps are required?
Select an answer first
37foundation · easy
What is the primary purpose of Wireshark's coloring rules?
Select an answer first
38application · medium
An analyst is analyzing a TCP conversation that contains a file transfer. The analyst wants to extract the exact data that was sent from the server to the client, excluding the client's acknowledgments and any retransmissions. What is the most effective method?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GCIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIA” is a trademark of its owner, used for identification only.