Adam, a malicious hacker, is sniffing an unprotected Wi-FI network located in a local store with Wireshark to capture hotmail e-mail traffic. He knows that lots of people are using their laptops for…

Question

Options

• A(http = "login.pass.com") && (http contains "SMTP")
• B(http contains "email") && (http contains "hotmail")
• C(http contains "hotmail") && (http contains "Reply-To")
• D(http = "login.passport.com") && (http contains "POP3")

• A
  13% (6)
• B
  2% (1)
• C
  79% (37)
• D
  6% (3)

Explanation

Option C is correct because Hotmail is a web-based email service that transmits messages over HTTP, and Reply-To is a standard RFC email header field present in actual email message content - so filtering for HTTP traffic containing both "hotmail" (identifying the service) and "Reply-To" (identifying actual email data) reliably isolates webmail messages on the wire.

Why the distractors fail:

• A is wrong on two counts: the = operator is invalid syntax for Wireshark's http display filter, and "login.pass.com" is a truncated/incorrect domain - it also conflates SMTP (a separate transport protocol) with HTTP-based webmail traffic.
• B fails because "email" is far too generic - it would match any webpage mentioning the word "email," not actual message content, producing massive false-positive noise.
• D uses the closer-to-correct domain (login.passport.com, Hotmail's old auth endpoint) but still has the invalid = syntax issue, and POP3 is an independent mail retrieval protocol that does not appear embedded inside HTTP streams.

Memory tip: Think "identify the service + identify the content." hotmail tells Wireshark whose traffic, and Reply-To is a real email header that proves you're looking at an actual message - not just a login page or a generic webpage.

No community discussion yet for this question.