EMT Practice Test

1. Question Content...

---

Question1: POP requests consist of a Request Command and Request Parameter.

Question2: By default, Wireshark will only dissect port 443 traffic as SSL/TLS traffic. If you are using another port for SSL/TLS communications, you must add that port number in the HTTP preferences setting for SSL/TLS ports.

Question3:
This is a DNS inverse query packet used to resolve an IP address to a host name.

Question4: The value *REF* in the Time column indicates that a packet has been marked.

Question5: DNS responses contain four sections: Question, Answer RR, Authority RR and Additional RR.

Question6: How do you quickly spot large gapsin time between packets in a trace file containing 6,000 packets?

Question7:
Which statement aboutthis color rule is correct?

Question8: In the case of a high latency path, more than three identical ACKs may be sent before the retransmission is seen in a trace file.

Question9: Which term defines an alias name used in DNS responses?

Question10: The TCP Time-Sequence graph can depict packet loss.

Question11: An unusually high number of RSTs or a high number of SYN/ACKs with no related data transfer is a strong indication that a TCP scan is underway.

Question12: Whichstatement about ICMP is true?

Question13: The Protocol Hierarchy Statistics window helps identify unusual protocols and applications in captured traffic.

Question14: The gratuitous ARP process is not required if a host is configured with a static IP address.

Question15: Which statement about TCP sequence and acknowledgment numbering is correct?

Question16:
Which statement about this packet is correct?

Question17: To increase the number of recently created display filters that Wireshark remembers, increase theFilter display max,list entriesvalue in Wireshark's Preferences window.

Question18: Promiscuous mode and monitor mode offer the same functionality.

Question19: Which transport is used for multicast and broadcast traffic?

Question20: Whichdisplay filter is used to display all DHCP traffic?

Question21: The capture filterport 67 would capture all DHCP traffic seen by Wireshark.

Question22: The capture and displayfilter syntax for TCP communications is tcp.

Question23: DNS can onlyresolve IP addresses to host names.

Question24: A TCP Acknowledgment Numberfield that is never incremented by a host after the TCP handshake indicates that no data is being received by that host.

Question25: Display filters areapplied to decrease the time required to identify the cause of poor network performance, unusual network traffic patterns or other traffic of interest.

Question26: Which protocol acts as the routable network layer protocol used to get packets from end-to-end on a TCP/IP network?

Question27:
What might be the purpose of thistraffic?

Question28: DHCP is based on BOOTP.

Question29:
This TCP Round Trip Time graph indicates thehighest round trip latency time seen in this trace file is 1 millisecond.

Question30: Columns can be reordered by dragging them into their new positions directly in the Packet List pane.

Question31: You can identify compromised hosts that are communicating with Command and Control (C&C) servers by capturing traffic close to the network egress point and filtering on the IP addresses of the suspect C&C servers.

Question32:
Which statement about this traffic is correct?

Question33: Port resolution can use the TCP/IP stack services file to determine the correct destination port to use in the TCP or UDP header.

Question34:
Which statement about the highlighted capture filter is correct?

Question35: A host has just booted up. This host is allowed to send ARP queries for the MAC address of thelocal DNS server before sending gratuitous ARPs to test for duplicate IP addresses on the network.