200-201 Question #168: Real Exam Question with Answer & Explanation

Question

Refer to the exhibit. What is shown in this PCAP file?

Options

• ATimestamps are indicated with error.
• BThe protocol is TCP.
• CThe User-Agent is Mozilla/5.0.
• DThe HTTP GET is encoded.

Explanation

The PCAP file exhibits an HTTP GET request where certain characters or parts of the URL or parameters are encoded.

Common mistakes.

• A. There is no common scenario where timestamps in a standard PCAP file are inherently "indicated with error" as a primary observable feature of the file's content in this context.
• B. While the underlying transport protocol for HTTP is typically TCP, stating "The protocol is TCP" is a generic observation and not a specific detail of an HTTP GET request that would differentiate it as the most specific thing shown, especially if encoding is present.
• C. A User-Agent string like "Mozilla/5.0" is common in HTTP requests, but it describes the client browser, not a specific characteristic or a unique feature shown by the HTTP GET request itself, like encoding.

Concept tested. PCAP analysis and HTTP request encoding

Reference. https://www.rfc-editor.org/rfc/rfc3986#section-2.1

No community discussion yet for this question.