Wireshark Traffic Analysis Practice Exam

These questions are part of the practice quiz. Start practicing

• Among the following, which method is specifically designed to hide the content of network traffic from observers?
• Which of the following are indicators of ICMP tunneling?
• What does a SYN/ACK indicate?
• What happens after the TLS handshake completes?
• What information can you see in the TLS Certificate message for each certificate in the chain?
• In a SYN scan, which statement is true regarding the handshake?
• How can you identify a TCP retransmission versus a normal out-of-order delivery in Wireshark?
• Which DHCP message indicates the server is proposing an IP address to the client?
• Which of the following can you see in TLS encrypted traffic?
• NBNS in local networks is best described as?
• Which protocol is commonly cited as transmitting credentials in cleartext?
• Why is NBNS useful in analysis?
• What is the security risk of a Log4j remote code execution?
• Which DHCP message is transmitted by a client to indicate it needs network configuration?
• Which display filter shows only DNS A record queries and their responses?
• Which indicates suspicious activity in a User-Agent?
• DHCP Request is ...?
• What ICMP message indicates a closed UDP port?
• What port does NBNS use?
• Which filter shows TLS handshake messages in Wireshark?
• Which of the following correctly pairs a packet type with its meaning?
• Which technology is used to protect data in transit for secure web pages?
• When must keys be captured?
• How can you export a list of unique IP addresses using Tshark?
• Which sequence describes the three steps of the TCP handshake?
• What method ensures confidentiality of communications between a web browser and a server?
• What is the purpose of a capture vs display filter, and when would you use each?
• Which display filter selects TLS Client Hello messages?
• Which of the following is an example of a firewall allow rule for a MAC address?
• Which pattern in a DNS capture is a sign of potential DNS tunneling?
• Which of the following is an example of a firewall deny rule?
• What is MSS and why is it important for TCP performance in a capture?
• Which order correctly describes the DHCP message flow from client to server?
• Identify the target hostname of a TLS-encrypted HTTP session in Wireshark without decrypting the payload.
• What is a User-Agent?
• How can you detect EDNS0 usage in DNS traffic?
• Which tool is commonly used for web fuzzing and brute force attacks?
• Which attack uses ARP spoofing to intercept traffic?
• Which option best describes a GET request?
• How can you detect a TCP zero window condition or zero-window probes?
• What is the first step of TLS handshake?
• What is a key indicator of port scanning activity?
• What is the effect of the TCP window scale option and how do you verify its use?
• What is a common ICMP message type?
• How can you identify HTTP keep-alive usage and the number of requests per connection?
• What is a typical NBNS query?
• How can you determine if a capture contains HTTP/2 frames?
• Why is ICMP used for tunneling?
• What vulnerability does Log4j exploit?
• Which menu path in Wireshark would you use to manage credentials?
• If DNS queries carry hidden data, which technique is in use?
• Which security mechanism is commonly used to protect traffic between a client and server in a browser session?
• How can you identify IPv6 extension headers in traffic?
• What pattern identifies Log4j exploitation?
• DHCP Acknowledge is ...?
• What is the standard method used to hide traffic from eavesdroppers on the internet?
• How can you use the Conversations view to analyze a single TCP session?
• Which tool commonly performs SYN scans?
• What is the risk of Log4j?
• Which of the following is a combined filter to capture HTTP requests or TLS Client Hello, while excluding SSDP?
• Which statement about ICMP is true?
• What is the purpose of the TCP three-way handshake?
• What does an ARP request look like?
• Which DHCP message confirms that an IP address has been assigned to a client?
• In securing browser traffic, which method provides confidentiality by encrypting the channel between client and server?
• Which Wireshark feature helps you handle IP fragmentation when analyzing TCP streams?
• Which message begins the TLS handshake from the client?
• To list all unique domain names resolved in a capture, which approach is recommended?
• Why does the scanner send RST after SYN/ACK?
• What term describes encryption of traffic to prevent eavesdropping on the network?
• Which statement best describes a DNS tunneling indicator?
• Which technology is designed to shield payloads by encrypting them in transit?
• How can you view the server certificate chain presented during a TLS handshake?
• How can you identify TCP slow-start behavior in a capture?
• What is another indicator of DNS tunneling?
• Which statement about a POST request is true?
• Which statement about ICMP tunneling is true?
• What is a SYN scan?
• What is NBNS used for?
• Which expression filters TLS Server Hello messages using the handshake_type field?
• Which technology is commonly used to secure browser traffic by encrypting the data in transit?
• Which Wireshark feature is used to plot throughput over time for a conversation?
• Is HTTP encrypted?
• What does HTTPS use for encryption?
• What does JNDI do in this context?
• How can you identify TLS alert messages and their meaning?
• Which string is commonly associated with Log4j exploitation patterns?
• How can you identify TLS versions negotiated in TLS 1.3 vs TLS 1.2?
• How can you identify HTTP responses that use chunked transfer encoding?
• In TCP slow-start, what pattern describes the congestion window?
• What is DHCP used for?
• How can you identify HTTP/2 negotiation via ALPN in a TLS ClientHello?
• In the example allow MAC rule, what is the MAC address?
• What does an ACK indicate?
• How can you measure throughput from a capture using built-in Wireshark tools?
• What stage comes after recon?
• To view only IPsec ESP packets in Wireshark, which display filter would you use?
• Which header indicates the compression encoding used for an HTTP response?
• How can you extract downloaded HTTP objects (files) from a capture?
• What is an indicator of DNS tunneling?
• What does a SYN packet indicate?
• What is ICMP tunneling?
• Which DHCP message is sent by the client to accept the offered IP address?
• Which filter expression returns only HTTP responses with status 429?
• In the TLS handshake sequence, what is the second step?
• How can you detect ARP spoofing or inconsistent ARP behavior?
• Which UDP ports are commonly used for IKE negotiation messages in IPsec-based VPNs?
• Which technique helps prevent eavesdropping on HTTP communications by wrapping them in encryption?
• What does it mean if no response is received from a UDP port?
• Does UDP use a handshake?
• How can you identify a TLS Finished message in the handshake?
• In IPsec, which protocol numbers identify ESP and AH in the IP header?
• How can you detect NXDOMAIN and other DNS failure responses?
• Which indicator in a TLS handshake suggests HTTP/2 negotiation via ALPN?
• To decrypt TLS traffic in Wireshark, which input is required?
• In the client-side steps of the handshake, which method finalizes the connection after receiving a SYN/ACK?
• Which file is used to decrypt HTTPS traffic in Wireshark?
• Which DNS record type is commonly observed in DNS tunneling patterns?
• How can you identify the TLS protocol version negotiated in a handshake?
• Why is Wfuzz suspicious?
• In the firewall rule examples, which component identifies the traffic source in a deny rule?
• DHCP Discover is ...?
• Which NBNS query type is commonly sent to discover names within a local network?
• What is the first stage of an attack?
• Which option is primarily responsible for hiding the content of network traffic within the HTTP protocol family?
• What does the TLS ServerKeyExchange message contain when using ECDHE?
• Which indicator besides unusually long domain names helps spot DNS tunneling patterns?
• What does ALPN stand for in TLS and what is its role?
• How can you verify if a DNS response was delivered over UDP or TCP in Wireshark?
• Which statement correctly describes ICMP echo messages?
• Which IPv6 extension header types can Wireshark identify?
• What statement describes what is visible after decrypting TLS traffic?
• Which mechanism is widely used to secure web communications by encrypting both request and response data?
• What protocol was found inside ICMP tunneling in the exercise?
• How can you verify a TLS certificate's issuer and validity dates within a handshake?
• What is a GET request?
• Why is DNS commonly abused?
• What is DNS used for?
• Which statement best describes the final packet in a standard TCP three-way handshake?
• Which statement best describes the role of TLS in HTTPS?
• How can you identify TLS handshake messages in a capture?
• How can you identify HTTP responses with client-side or server errors?
• What does ARP spoofing involve?
• Which approach filters the capture to TLS handshake messages?
• How can you detect IPsec VPN traffic in a capture?
• In a DNS response, where would you look to detect a large number of A records for a single query?
• Which Wireshark view is commonly used to locate large data transfers between two endpoints?
• What is the primary purpose of firewall rules?
• What approach helps determine the origin of traffic when capturing from multiple hosts?
• Which of the following represents a normal User-Agent?
• ARP flooding is defined as
• Where in the TLS handshake is the Server Name Indication (SNI) value carried?
• What does a sequence of duplicate ACKs indicate in TCP traffic?
• What is a key indicator of ARP spoofing?
• What is the practical benefit of identifying credentials in a capture?
• Which statement about UDP is true?
• If you capture traffic from multiple hosts, which method helps identify the origin host for a given activity?
• Which of the following best describes a sign of tunneling when SSH appears inside ICMP?
• Which option is a protocol suite that provides end-to-end encryption for web traffic?
• Where is the Maximum Segment Size (MSS) information typically shown in Wireshark?
• What is a suspicious HTTP indicator?
• What is DNS tunneling?
• In the exercise, which domain was flagged as suspicious?
• How can you identify the top talkers in a capture?
• What becomes visible after decryption?
• How can you use Wireshark Expert Info to identify anomalies?
• Which condition is signaled when the receiver's window size becomes zero and probes are sent?
• What suspicious domain was identified in the exercise?
• What is the Protocol Hierarchy view used for in Wireshark?
• NBNS queries run over which port?
• What is a POST request?
• What is a key indicator of UDP scanning?
• Which option is commonly used to secure communications by encrypting requests and responses on the web?
• How can you inspect HTTP content after decryption of TLS traffic?
• Which factor makes DNS attractive for abuse?
• Which mechanism is commonly used to hide traffic from eavesdroppers on the network?
• Which statement best describes the relationship between reconnaissance and exploitation?
• If a target port replies with a SYN/ACK to a SYN probe, what does that imply about the port in the context of a SYN scan?
• What packet pattern indicates an open port?
• Which item cannot be observed in TLS encrypted traffic?
• How can you verify a successful TCP three-way handshake in a capture?
• Which scenario would most likely reveal credentials due to plaintext transmission?
• Which metric would you compare to assess whether a load balancer distributes traffic evenly across backend servers?
• Which of the following indicates EDNS0 support in a DNS message?
• Which statement best describes the content of an ARP reply?
• What packet pattern indicates a closed port?
• Which technique enables MITM?
• Which HTTP header is most commonly used to indicate a request passed through a proxy server?
• Which of the following statements about UDP is true?
• When focusing on TLS handshake messages in Wireshark, which filter would you apply?
• Which tool was identified in the capture?
• What is ICMP used for?
• In TLS, which statement about the order of Client Hello and Server Hello is true?
• Which DHCP option number is used to convey the host name?
• Which DNS field stores the domain name in a DNS query?
• How do you detect closed UDP ports?
• How do you reconstruct a complete HTTP conversation spanning multiple TCP segments in Wireshark?
• What file is needed to decrypt HTTPS?
• What is used for stealth communication?
• Which expression filters TLS Client Hello messages using the handshake_type field?
• In Wireshark, where are credentials configured for decryption or filtering?
• Which display filter identifies DNS A record responses?
• Which display filter selects TLS Server Hello messages?
• Which observation indicates the start of a TLS handshake?
• Which filter isolates TLS traffic for inspection in Wireshark?
• Where can you extract the TLS cipher suite used in a handshake?
• DHCP Offer is ...?
• What is ARP used for?
• How do you decrypt TLS traffic in Wireshark to inspect application data?
• How can you distinguish between ECDHE and RSA key exchange in a TLS handshake?