Free Wireshark Certified Network Analyst Exam WCNA Exam Practice Test

Both the capture and display filter syntax for ARP requests and replies is arp.

• True
• False

The IPv4 Total Length field defines the length of the IP header, valid data and data link padding.

• True
• False

You can force Wireshark to temporarily dissect traffic to and from port 18067 as IRC traffic using the Decode As function.

• True
• False

Window scaling is established during the TCP handshake process to enable hosts to use largerwindow sizes than is 65,535.

• True
• False

What is the most efficient method for saving non-contiguous packets in a trace file?

• Mark the packets and choose to save the marked packets.
• Apply a color filter for each packet and save all colored packets.
• Right click and copy the packets individually to a new instance of Wireshark.
• Open the packets in a new window and save them under the same file name.

The coloring of packets that match the Bad TCP default coloring rule is permanent and cannot be edited.

• True
• False

The capture filter port 67 would capture all DHCP traffic seen by Wireshark.

• True
• False

With a few exceptions, display filters use the same syntax as capture filters.

• True
• False

You are performing a TCP scan on a target while capturing your traffic with Wireshark. Which statement about the analysis is correct?

• If you receive TCP Push responses, the target port is blocked.
• If you receive ICMP responses, the target port is likely firewalled.
• If only UDP responses are received, the target does not support TCP.
• If a TCP RST response is received, the target is not currently powered up.

Network congestion is defined as a condition that can cause packet loss or slow data transfer because the network itself cannot support the data transfer rate.

• True
• False