EMT Practice Test

1. Question Content...

---

Question1: An unusually high number of RSTs or a high number of SYN/ACKs with no related data transfer is a strong indication that a TCP scan is underway.

Question2: The ip.addr != 10.2.4.1 display filter shows all packets except ones that contain the address 10.2.4.1 in the source or destination IP address fields.

Question3: During an ideal data transfer process, the TCP Time-Sequence graph plot points should run from the lower left corner to the upper rightcorner in a diagonal line of i-bars.

Question4: The capture filterport 67 would capture all DHCP traffic seen by Wireshark.

Question5: The capture and displayfilter syntax for TCP communications is tcp.

Question6: What is the most efficient method for saving non-contiguous packets in a trace file?

Question7: 1O Graphs supportdisplay filters and expressions.

Question8: A host has just booted up. This host is allowed to send ARP queries for the MAC address of thelocal DNS server before sending gratuitous ARPs to test for duplicate IP addresses on the network.

Question9: TCP data is sequenced and acknowledged to ensure delivery.

Question10: The coloring of packets that match theBadTCPdefault coloring rule is permanent and cannot be edited.

Question11: Which term defines an alias name used in DNS responses?

Question12: Which transport is used for multicast and broadcast traffic?

Question13: When you apply a display filter, the Status Bar indicates the total number ofpackets captured and the packets displayed.

Question14: The UDP header checksum isoptional.

Question15: Which name resolution process translates port numbers to service names if they are listed in Wireshark's services file?

Question16: When you disable the UDP protocol decoding process, applications that use UDP (such as DHCP and DNS) will not bedecoded.

Question17: To increase the number of recently created display filters that Wireshark remembers, increase theFilter display max,list entriesvalue in Wireshark's Preferences window.

Question18: Wireshark's Export feature can be used to identify HTTP objects and reassemble them into their original format.

Question19: The Protocol Hierarchy Statistics window helps identify unusual protocols and applications in captured traffic.

Question20: You may need to capture traffic at different points on the network to identify the location of packet loss.

Question21: ICMP is used as a messaging system for errors, alerts,and general notifications on an IP network.

Question22: What is the purpose of creating Wireshark profiles?

Question23: Both sides of a TCP connection must negotiate a common receive window size value.

Question24: You can identify compromised hosts that are communicating with Command and Control (C&C) servers by capturing traffic close to the network egress point and filtering on the IP addresses of the suspect C&C servers.

Question25: Wireshark's GeoIP feature launches an OpenStreetMap view of the world from the Endpoints window to plot IP addresses seen in the trace file.

Question26: Port resolution can use the TCP/IP stack services file to determine the correct destination port to use in the TCP or UDP header.

Question27:
Which statement about this packet is correct?

Question28: Which format is used by capture filters?

Question29: Applications may override the default port value defined in the TCP/IP stack services file.

Question30:
Which statement about this packet is correct?

Question31: DNS can onlyresolve IP addresses to host names.

Question32:
Which statement about the Capture Options window shown is correct?

Question33: Both the capture and display filter syntax for ARP requests and replies is arp.

Question34:
Whichstatement about this HTTP packet is correct?