Wireshark WCA-101 - Wireshark Certified Analyst Exam
Page: 3 / 10
Total 46 questions
Question #11 (Topic: Exam A)
Where was this packet capture taken?
A. One hop from the server
B. One hop from the client
C. On the server
D. There is not enough detail provided to determine this
E. On the client
Answer: B
Question #12 (Topic: Exam A)
Note: This question is weighted as 2x the value of other questions.
All packets leaving 10.0.0.10 will pass through a source NAT process on the Router.
Below is a packet captured on 10.0.0.10. What will the same packet look like when captured with the network tap located at the arrow in the above drawing?
A. 
B. 
C. 
D. 
B.
C.
D.
Answer: B
Question #13 (Topic: Exam A)
Which filter will display all traffic EXCEPT for arp and lldp?
A. !(arp or lldp)
B. !(arp and lldp)
C. no arp/lldp
D. !arp or !lldp
Answer: A
Question #14 (Topic: Exam A)
Which filter will show all TCP reset packets?
A. tcp.flags.reset == 1
B. tcp.reset == 1
C. tcp.flags == 3
D. tcp.analysis.flags.resets
Answer: A
Question #15 (Topic: Exam A)
You are troubleshooting a slow file transfer and want to filter for low TCP receive windows. The screenshots above show views of the TCP header on an ACK packet from the receiver. Which field would best be used to create this filter?
A. tcp.window_size
B. tcp.window_size_value
C. tcp.calc.window
D. tcp.analysis.flags
Answer: A
