nerdexam
Cisco

200-201 · Question #334

Refer to the exhibit. Which frame numbers contain a file that is extractable from Wireshark PCAP?

The correct answer is D. All Frames from No. 20061 to 20064. A file extractable from a Wireshark PCAP typically spans multiple consecutive frames that collectively constitute the complete data transfer of that file via protocols like HTTP or FTP.

Submitted by skyler.x· Mar 6, 2026Network Intrusion Analysis

Question

Refer to the exhibit. Which frame numbers contain a file that is extractable from Wireshark PCAP?

Exhibit

200-201 question #334 exhibit

Options

  • AFrames No. 20064 and 20066
  • BFrame No. 20064
  • CFrame No. 20086
  • DAll Frames from No. 20061 to 20064

How the community answered

(54 responses)
  • A
    6% (3)
  • B
    4% (2)
  • C
    17% (9)
  • D
    74% (40)

Why each option

A file extractable from a Wireshark PCAP typically spans multiple consecutive frames that collectively constitute the complete data transfer of that file via protocols like HTTP or FTP.

AFrames No. 20064 and 20066

It is unlikely a file extraction would occur from only two potentially non-consecutive frames, especially if other frames are part of the same data stream.

BFrame No. 20064

A single frame is highly unlikely to contain an entire extractable file, as most files are larger than what a single network packet can hold.

CFrame No. 20086

Frame No. 20086, if not part of the contiguous data transfer identified by Wireshark's file extraction logic, would not individually or in combination with other frames from a different stream constitute the same extractable file.

DAll Frames from No. 20061 to 20064Correct

Files transferred over protocols like HTTP or FTP are often broken down into multiple packets and transmitted across several frames in a PCAP. For Wireshark to successfully extract a complete file, all the frames that contain segments of that file's data stream, such as those from 20061 to 20064, must be included.

Concept tested: Wireshark file extraction from PCAP

Source: https://www.wireshark.org/docs/wsug_html_chunked/ChProtExportObjects.html

Topics

#Wireshark#PCAP analysis#file extraction#network forensics

Community Discussion

No community discussion yet for this question.

Full 200-201 Practice