nerdexam
Cisco

200-201 · Question #305

Refer to the exhibit. An engineer received a ticket about a slowdown of a web application. During analysis of traffic, the engineer suspects a possible attack on a web server. How should the engineer

The correct answer is B. 10.0.0.2 sends GET / HTTP / 1.1 and POST requests, and the target responds with HTTP/1.1. The Wireshark capture shows that IP address 10.0.0.2 is sending both GET and POST HTTP requests to a target, which then responds with HTTP/1.1 200 OK messages.

Submitted by diego_uy· Mar 6, 2026Network Intrusion Analysis

Question

Refer to the exhibit. An engineer received a ticket about a slowdown of a web application. During analysis of traffic, the engineer suspects a possible attack on a web server. How should the engineer interpret the Wireshark traffic capture?

Exhibit

200-201 question #305 exhibit

Options

  • A10.128.0.2 sends HTTP / FORBIDDEN / 1.1 and GET requests, and the target responds with
  • B10.0.0.2 sends GET / HTTP / 1.1 and POST requests, and the target responds with HTTP/1.1
  • C10.128.0.2 sends POST / HTTP / 1.1 and GET requests, and the target responds with HTTP/1.1
  • D10.0.0.2 sends HTTP / FORBIDDEN / 1.1 and POST requests, while the target responds with

How the community answered

(53 responses)
  • A
    9% (5)
  • B
    68% (36)
  • C
    4% (2)
  • D
    19% (10)

Why each option

The Wireshark capture shows that IP address 10.0.0.2 is sending both GET and POST HTTP requests to a target, which then responds with HTTP/1.1 200 OK messages.

A10.128.0.2 sends HTTP / FORBIDDEN / 1.1 and GET requests, and the target responds with

This option incorrectly states that 10.128.0.2 is sending the requests and that responses are 'FORBIDDEN', neither of which is shown in the capture.

B10.0.0.2 sends GET / HTTP / 1.1 and POST requests, and the target responds with HTTP/1.1Correct

The traffic capture clearly indicates packets originating from 10.0.0.2 sending `GET / HTTP/1.1` and `POST / HTTP/1.1` requests, and the target IP, 10.128.0.2, responding with `HTTP/1.1 200 OK` messages, signifying successful responses.

C10.128.0.2 sends POST / HTTP / 1.1 and GET requests, and the target responds with HTTP/1.1

This option incorrectly identifies 10.128.0.2 as the source of the GET and POST requests, which are actually sent by 10.0.0.2.

D10.0.0.2 sends HTTP / FORBIDDEN / 1.1 and POST requests, while the target responds with

This option incorrectly states that 'HTTP / FORBIDDEN / 1.1' is sent as a request type and that the target's response is not fully described as 200 OK.

Concept tested: Wireshark HTTP traffic analysis

Source: https://www.wireshark.org/docs/dfref/h/http.html

Topics

#HTTP Traffic Analysis#Packet Capture#Web Server Attacks#Wireshark

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 200-201 Practice