nerdexam
Cisco

200-201 · Question #168

Refer to the exhibit. What is shown in this PCAP file?

The correct answer is D. The HTTP GET is encoded. The PCAP file exhibits an HTTP GET request where certain characters or parts of the URL or parameters are encoded.

Submitted by luis.pe· Mar 6, 2026Network Intrusion Analysis

Question

Refer to the exhibit. What is shown in this PCAP file?

Exhibit

200-201 question #168 exhibit

Options

  • ATimestamps are indicated with error.
  • BThe protocol is TCP.
  • CThe User-Agent is Mozilla/5.0.
  • DThe HTTP GET is encoded.

How the community answered

(52 responses)
  • A
    6% (3)
  • B
    2% (1)
  • C
    13% (7)
  • D
    79% (41)

Why each option

The PCAP file exhibits an HTTP GET request where certain characters or parts of the URL or parameters are encoded.

ATimestamps are indicated with error.

There is no common scenario where timestamps in a standard PCAP file are inherently "indicated with error" as a primary observable feature of the file's content in this context.

BThe protocol is TCP.

While the underlying transport protocol for HTTP is typically TCP, stating "The protocol is TCP" is a generic observation and not a specific detail of an HTTP GET request that would differentiate it as the most specific thing shown, especially if encoding is present.

CThe User-Agent is Mozilla/5.0.

A User-Agent string like "Mozilla/5.0" is common in HTTP requests, but it describes the client browser, not a specific characteristic or a unique feature shown by the HTTP GET request itself, like encoding.

DThe HTTP GET is encoded.Correct

A PCAP file showing an HTTP GET request where special characters or spaces within the URL or parameters have been replaced with their percent-encoded equivalents (e.g., %20 for a space) indicates that the HTTP GET request is encoded.

Concept tested: PCAP analysis and HTTP request encoding

Source: https://www.rfc-editor.org/rfc/rfc3986#section-2.1

Topics

#PCAP analysis#HTTP GET#URL encoding#network forensics

Community Discussion

No community discussion yet for this question.

Full 200-201 Practice