Updated WCNA Dumps (V9.02) – You Can Learn the Latest Practice Questions to Pass the Wireshark Certified Network Analyst (WCNA) Certification Exam

1. You are analyzing network traffic, but you only see ARP queries - you do not see any ARP responses.

What could cause this situation?

2. Which display filter is used to display all DHCP traffic?

3. Which network problem may cause packet loss, queuing, or throttling of possible throughput maximums?

4. Session Initiation Protocol (SIP) is a protocol that can be used to carry voice data.

5. You will only see the TCP Urgent Pointer field if the URG bit is set to 1 in a TCP packet.

6. RTP provides transport functions for real-time data such as audio, video or simulation data over multicast or unicast network services.

7. You are performing a TCP scan on a target while capturing your traffic with Wireshark.

Which statement about the analysis is correct?

8. Refer to the exhibit.

This packet was sent from an HTTP client.

9. Wireshark can be used to capture, reassemble and playback encrypted VoIP conversations.

10. The ip.addr != 10.2.4.1 display filter shows all packets except ones that contain the address 10.2.4.1 in the source or destination IP address fields.

11. POP requests consist of a Request Command and Request Parameter.

12. Which protocol is used to locate the hardware address of a local target or local router?

13. DHCP is based on BOOTP.

14. The capture filter port 67 would capture all DHCP traffic seen by Wireshark.

15. The TCP Time-Sequence graph can depict packet loss.

16. Refer to the exhibit.

This TCP Round Trip Time graph indicates the highest round trip latency time seen in this trace file is 1 millisecond.

17. DNS responses contain four sections: Question, Answer RR, Authority RR and Additional RR.

18. The IPv4 Total Length field defines the length of the IP header, valid data and data link padding.

19. Time reference packets are permanently given a timestamp of 00:00:00. When you close and reopen the trace file the time reference information is retained.

20. An unusually high number of RSTs or a high number of SYN/ACKs with no related data transfer is a strong indication that a TCP scan is underway.

21. Refer to the exhibit.

The image depicts eight files that are part of a file set.

22. Refer to the exhibit.

Which statement about the highlighted capture filter is correct?

23. ICMP is used as a messaging system for errors, alerts, and general notifications on an IP network.

24. Applications may override the default port value defined in the TCP/IP stack services file.

25. DNS can only resolve IP addresses to host names.

26. Wireshark can import CSV (comma separated value) format files for further analysis.

27. The UDP header checksum is optional.

28. Which function provides host name-to-IP address resolution services?

29. You can force Wireshark to temporarily dissect traffic to and from port 18067 as IRC traffic using the Decode As function.

30. Refer to the exhibit.

Which statement about the Capture Options window shown is correct?

31. Refer to the exhibit.

This image shows frame 2781 which is a Window Update packet. This packet indicates that 10.0.52.164's TCP Window Size field value has increased since the last packet sent by that host.

32. Which statement about packet timestamps is correct?

33. Wireshark contains numerous pre-defined columns that can be added easily to the Packet List pane.

34. Which name resolution process translates port numbers to service names if they are listed in Wireshark's services file?

35. Refer to the exhibit.

This is a DNS inverse query packet used to resolve an IP address to a host name.