1. If the UDP protocol decoding process is disabled in Wireshark, applications that use UDP (such as DHCP and DNS) can still be decoded.

Question 1 of 50

2. This protocol acts as the routable network layer protocol and used to get packets from end-to end on a TCP/IP network, Identify this protocol.

Question 2 of 50

3. Any ICMP packets does not include portions of the original packet which triggered the ICMP response.

Question 3 of 50

4. High number of RSTs or a high number of SYN/ACKs with no related data transfer, this clearly indicates that TCP scan is in progress.

Question 4 of 50

5. GeoIP feature available in Wireshark launches an OpenStreetMap view of the world from the Endpoints window to plot IP addresses which are captured in the trace file.

Question 5 of 50

6. Identify a correct statement about TCP acknowledgment & sequence numbering.

Question 6 of 50


This TCP Round Trip Time graph indicates the highest round trip latency time seen in this
trace file is 1 millisecond.

Question 7 of 50


Identify a correct statement for the packet shown in below image.

Question 8 of 50


Wireshark can import CSV (comma separated value) format files for further analysis.

Question 9 of 50

10. Wireshark's Export feature can be used to identify HTTP objects and reassemble them into
their original format.

Question 10 of 50

A custom column can be added to and rearranged in the Packet List pane.

Question 11 of 50


Which statement about the TCP stream shown below is correct ?

Question 12 of 50

13. Which driver is used to capture packets when Wireshark is running on a Apple computer?

Question 13 of 50

14. Which of these filters can be used both as a capture and display filter ?

Question 14 of 50

15. Which format is used by capture filters ?

Question 15 of 50


Which statement about the settings shown in the Preferences window below is correct ?


Question 16 of 50

17. What is the purpose of creating Wireshark profiles?

Question 17 of 50

18. Wireshark can playback encrypted VoIP conversations.

Question 18 of 50

19. Which display filter shows all the TCP Expert Infos warnings and notes ?

Question 19 of 50


Any display filters created and saved while viewing the trace file shown above will be saved in the 'Default' profile directory.

Question 20 of 50


Which statement about the highlighted capture filter shown below is correct?

Question 21 of 50

22. Which display filter is used to view all DHCPv4 traffic ?

Question 22 of 50

23. Which traffic type may be seen when you connect Wireshark directly to a switch without configuring port spanning or port mirroring?

Question 23 of 50

24. Which address type can be mapped with Wireshark's GeoIP mapping services?

Question 24 of 50

25. Which traffic characteristic is commonly seen when analyzing database record transfers?

Question 25 of 50

26. Which communication can be used by a host to dynamically join a multicast group?

Question 26 of 50

27. How can you quickly identify all WLAN BSSIDs seen in a trace file?

Question 27 of 50

28. Which Wireshark element can be created using the display filter syntax?

Question 28 of 50

29. How do you determine which Profile is in use while you are capturing traffic?

Question 29 of 50

30. Which item can be saved with a Wireshark profile?

Question 30 of 50

31. Which statement about the Coloring Rules configuration shown below is correct ?


Question 31 of 50

32. Which statement about capture filters is correct?

Question 32 of 50

33. Which Advanced IO Graph Calc function would be best for graphing the frequency of tcp.analysis.retransmission packets?

Question 33 of 50

34. Why can't ARP packets be routed?

Question 34 of 50

35. Which condition could cause you to see ARP queries, but not ARP responses in a trace?

Question 35 of 50

36. What term does Wireshark use to define TCP retransmissions that occur within 20 ms of a Duplicate ACK?

Question 36 of 50

37. What is the maximum value that can be defined in the TCP Window Size field?

Question 37 of 50

38. Which statement about DHCP communications is correct?

Question 38 of 50


Which statement about the packet shown above is correct ?

Question 39 of 50


Which statement about the ICMP packet shown below is correct?

Question 40 of 50

41. Which file contains the TCP Expert information ?


Question 41 of 50

42. What type of device can alter IP header addressing?

Question 42 of 50

43. Which transport layer protocol is used for multicast traffic?

Question 43 of 50

44. Which step is required when you want to export the TCP Calculated Window Size information shown in the packet below for analysis in a CSV format file?


Question 44 of 50


Which DNS function is used to enable a target DNS server to ask another server for an answer on behalf of the DNS client?

Question 45 of 50

46. Which feature is supported by IO Graphs ?

Question 46 of 50

47. Which statement about TCP sequence and acknowledgment numbering is correct?

Question 47 of 50


Which statement about the DNS packet shown below is correct?


Question 48 of 50


Which statement about the packet shown below is correct ?

Question 49 of 50

50. What is the purpose of a DNS CNAME?

Question 50 of 50