WEEK 1 Quize

Wireshark – Week 1 Quiz

1. What is the main purpose of Wireshark in this course?

A. Designing new network topologies B. Analyzing network packets for troubleshooting and security C. Installing operating systems on servers D. Managing user accounts and passwords

2. Which file type is used for the Wireshark lab captures in this course?

A. .txt B. .pcapng C. .zip D. .capx

3. Where can students find the embedded lab questions inside a PCAP file?

A. Edit > Preferences B. Statistics > Capture File Properties > Comments tab C. View > Layout D. View > Coloring Rules

4. The learning approach in this course is best described as:

A. Theory-heavy lecture-based learning B. Activity-based and scenario-driven learning C. Multiple-choice exam practice only D. Self-study with no lab work

5. During Wireshark installation on Windows, which component must be selected for packet capturing?

A. Wireshark PDF Viewer B. Npcap packet driver C. USBPcap (only) D. Wireshark Script Engine

6. After installation, where do you usually start Wireshark on Windows?

A. Only from a desktop shortcut B. From the Start Menu program list C. From Device Manager D. Automatically as a background service

7. In Lab 1, which question type is commonly answered by looking at packet numbers and counts?

A. Which profile is active B. How many packets were captured C. Which port is 80 used by D. Which TCP flags are defined in RFC

8. What does a Wireshark profile mainly store?

A. Captured packets for offline analysis B. Customized settings such as columns, colors, and layout C. Usernames and passwords D. Only the Windows desktop theme

9. How do you create a new profile in Wireshark?

A. Right-click the current profile name and choose “New” B. Start a capture; a profile is created automatically C. Install a new plugin D. Edit > Copy as New Profile

10. Which menu path lets you add or edit columns like Delta Time?

A. Edit > Preferences > Columns B. View > Layout C. Statistics > Conversations D. Capture > Options > Columns

11. Which column type should be chosen to display “Delta Time Displayed”?

A. Time Since System Boot B. Delta Time Displayed C. TCP Sequence Time D. IP TTL Delta

12. To change the way time is displayed in packet list (for example, seconds since capture start), which menu is used?

A. View > Time Display Format B. Edit > Preferences > Columns C. Capture > Options D. View > Coloring Rules

13. How can you quickly add “Source Port” and “Destination Port” as columns?

A. Edit > Preferences > Ports B. Right-click the port field in Packet Details and select “Apply as Column” C. Capture > Options > Ports D. Analyze > Display Filters

14. What is the effect of customizing layout under Edit > Preferences > Layout?

A. It changes which capture filters are available B. It changes how the main Wireshark panes are arranged C. It changes the Windows theme D. It saves a new profile to disk

15. What is the purpose of coloring rules in Wireshark?

A. To speed up packet capture B. To highlight packets matching specific filter expressions C. To repair corrupted packets D. To export packet captures into Excel

16. Which display filter highlights TCP SYN packets in the example coloring rule?

A. tcp.flags.fin == 1 B. tcp.flags.syn == 1 C. icmp.type == 8 D. tcp.port == 80

17. What is the main advantage of using filter buttons?

A. They increase the NIC speed B. They provide one-click access to commonly used display filters C. They automatically export captures to CSV D. They create new profiles for every capture

18. Capture filters are applied:

A. Before capturing, to limit which packets are stored B. After capturing, to hide packets temporarily C. On the switch hardware only D. Only in high-security networks

19. Display filters are applied:

A. Before the capture starts B. After capture, to refine which packets are shown C. To modify source MAC addresses D. Only when analyzing IPv6 traffic

20. Which is a recommended best practice in the document?

A. Always capture narrowly with many capture filters B. Capture comprehensively, then use display filters for analysis C. Do not capture anything; use logs only D. Capture only ICMP packets at all times

21. A display filter generally follows the structure:

A. Protocol Value Operator B. Field Operator Value C. Source Destination Operator D. MAC Operator IP

22. Which field matches traffic to or from a host, regardless of direction?

A. ip.src B. ip.dst C. ip.addr D. ip.ttl

23. Which filter correctly matches all TCP traffic on port 80?

A. ip.port == 80 B. tcp.port == 80 C. udp.port == 80 D. tcp == 80

24. Which operator checks if a field’s value is in a list or range?

A. contains B. in C. matches D. ==

25. Which operator performs case-sensitive substring matching?

A. contains B. matches C. in D. !=

26. What does the field frame.len represent?

A. Total length of the captured frame in bytes B. Number of hops remaining C. Capture start time D. TCP window size

27. What does ip.ttl represent in a packet?

A. Payload size in bytes B. Time To Live value C. IP Identification field D. Destination MAC address

28. Which capture method gives a full-duplex, accurate view without interrupting the link but requires physical access?

A. Endpoint capture on the client B. SPAN/mirror port on a switch C. Network tap in the path D. Wireless monitor mode only

29. Which capture approach is usually the easiest and cheapest to deploy?

A. Endpoint capture on the client or server B. Dedicated hardware network taps everywhere C. Configuring SPAN on every switch D. Deploying probes on every router

30. Which of the following is a key pre-capture planning question mentioned in the document?

A. Which color scheme should Wireshark use? B. Which users, systems, or applications are impacted? C. Which web browser does the analyst prefer? D. What Wi-Fi password should be used?