Free Wireshark Certified Network Analyst Exam WCNA Exam Practice Test

How do you determine which Profile is in use while you are capturing traffic?

• Examine the Wireshark Title Bar.
• Look in the Status Bar Profile column.
• Right-click on the Packet Summary pane.
• Open the Preferences | Interface information.

Session Initiation Protocol (SIP) is a protocol that can be used to carry voice data.

• True
• False

The capture and display filter syntax for TCP communications is tcp.

• True
• False

Which display filter is used to display all DHCP traffic?

• dhcp
• bootp
• tcp.port==68
• udp.dst.port==67

You can identify compromised hosts that are communicating with Command and Control (C&C) servers by capturing traffic close to the network egress point and filtering on the IP addresses of the suspect C&C servers.

• True
• False

IP routers strip off the MAC header of incoming packets and apply a new MAC header before forwarding the packet onto the next network.

• True
• False

Network analysis is often considered 'electronic surveillance' or 'wiretapping* and may be illegal.

• True
• False

When you disable the UDP protocol decoding process, applications that use UDP (such as DHCP and DNS) will not be decoded.

• True
• False

The Prepare a Filter feature creates a display filter in the display filter window, but does not apply the filter to the traffic.

• True
• False

Wireshark's GeoIP feature launches an OpenStreetMap view of the world from the Endpoints window to plot IP addresses seen in the trace file.

• True
• False