200-201 · Question #401
What can be identified from the exhibit?
The correct answer is D. tcpdump data. Assuming the exhibit displays raw network packet capture details, it represents tcpdump data, which captures and displays packets flowing over a network interface.
Question
What can be identified from the exhibit?
Exhibit
Options
- ANetFlow data
- Bspoofed TCP reset packets
- CDNS hijacking
- Dtcpdump data
How the community answered
(26 responses)- B4% (1)
- C8% (2)
- D88% (23)
Why each option
Assuming the exhibit displays raw network packet capture details, it represents tcpdump data, which captures and displays packets flowing over a network interface.
NetFlow data provides summarized network traffic statistics (who, what, when, where, how much), not the raw packet content and detailed headers typically seen in a tcpdump output.
While tcpdump could show spoofed TCP reset packets, 'spoofed TCP reset packets' describes a type of attack or specific traffic, not the generic format of the data presented in a raw capture.
DNS hijacking is a type of attack, and while tcpdump data could help identify it, 'DNS hijacking' is not the description of the raw packet capture data itself.
tcpdump is a command-line packet analyzer that captures and displays network packets, providing raw data like source/destination IP addresses, ports, protocols, and packet contents. If the exhibit shows this type of granular, byte-level network traffic information, it is accurately described as tcpdump data.
Concept tested: Identification of raw packet capture data
Topics
Community Discussion
No community discussion yet for this question.