EMT Practice Test

1. Question Content...

---

Question1: DNS can onlyresolve IP addresses to host names.

Question2: The ip.addr != 10.2.4.1 display filter shows all packets except ones that contain the address 10.2.4.1 in the source or destination IP address fields.

Question3: The TCP Time-Sequence graph can depict packet loss.

Question4: POP requests consist of a Request Command and Request Parameter.

Question5: The gratuitous ARP process is not required if a host is configured with a static IP address.

Question6: DHCP is based on BOOTP.

Question7: To increase the number of recently created display filters that Wireshark remembers, increase theFilter display max,list entriesvalue in Wireshark's Preferences window.

Question8: The IPv4 Total Length field defines the length of the IP header, valid data and data link padding.

Question9: 1O Graphs supportdisplay filters and expressions.

Question10: Which name resolution process translates port numbers to service names if they are listed in Wireshark's services file?

Question11: You can force Wireshark to temporarily dissect traffic to and fromport 18067 as IRC traffic using the Decode As function.

Question12: Both sides of a TCP connection must negotiate a common receive window size value.

Question13: TCP data is sequenced and acknowledged to ensure delivery.

Question14: Applications may override the default port value defined in the TCP/IP stack services file.

Question15: The Protocol Hierarchy Statistics window helps identify unusual protocols and applications in captured traffic.

Question16: Wireshark can be used to capture, reassemble and playback encrypted VoIP conversations.

Question17: How do you determine which Profile is in use while you are capturing traffic?

Question18: An unusually high number of RSTs or a high number of SYN/ACKs with no related data transfer is a strong indication that a TCP scan is underway.

Question19: Window scaling is established during the TCP handshake process to enable hosts to use larger window sizes than is 65,535.

Question20: What is the purpose of creating Wireshark profiles?

Question21:
Which statement about this packet is correct?

Question22: What is the most efficient method for saving non-contiguous packets in a trace file?

Question23: Display filters areapplied to decrease the time required to identify the cause of poor network performance, unusual network traffic patterns or other traffic of interest.

Question24: Which statement about TCP sequence and acknowledgment numbering is correct?

Question25: With a few exceptions, display filters use the same syntax as capture filters.

Question26:
Which statement about the Capture Options window shown is correct?

Question27: Which term defines an alias name used in DNS responses?

Question28:
This is a DNS inverse query packet used to resolve an IP address to a host name.

Question29: Some ICMP packets include portions of the original packet that triggered the ICMP response.

Question30: Baselines of basic VoIP traffic patterns should include analysis of the call setup and actual call process traffic.

Question31:
Which statement about this Wireshark image is correct?

Question32: You have opened a trace file that has been sent to you and you noticed the timestamp only offers millisecond-level time values. You can enable Wireshark to add themicrosecond detail information to these packets.

Question33: Wireshark's GeoIP feature launches an OpenStreetMap view of the world from the Endpoints window to plot IP addresses seen in the trace file.

Question34: By default, Mergecap combinestrace files based on the order they are listed on the command-line.