WCNA Practice Test

WCNA practice test: what's covered

• Packet analysis
• TCP/IP forensics
• Wireshark mastery

Free WCNA sample questions

1. A network engineer is evaluating packet capture hardware for a high-traffic 10Gbps backbone link where zero packet loss is required. How do a Switched Port Analyzer (SPAN) port and a hardware Test Access Point (TAP) differ in high-load scenarios?

   • A. TAP is a passive hardware splitter that guarantees zero frame loss under high link utilization, whereas SPAN depends on switch CPU/ASIC buffers and can drop mirrored frames when oversubscribed.
   • B. SPAN is a physical inline hardware device that prevents packet dropping, while TAP operates at the OS driver level and drops packets during buffer congestion.
   • C. TAP operates exclusively at Layer 2 for unidirectional traffic, whereas SPAN processes Layer 3 through Layer 7 headers for bidirectional analysis.
   • D. SPAN automatically decrypts encrypted TLS packets at hardware speeds, whereas TAP captures raw encrypted frames requiring external private keys.
   Show answer

   Correct: A. The correct answer is that TAPs passively split physical signals without switch queue overhead, guaranteeing zero frame loss even under 100% link saturation. The other options are incorrect because SPAN is a switch port mirror feature (not physical inline hardware), TAP is not restricted to Layer 2 unidirectional traffic, and SPAN does not perform automated TLS payload decryption.

2. A network administrator configures dumpcap with the BPF capture filter "tcp port 443 and host 10.10.10.5". Which two statements accurately describe how libpcap processes packets using this filter?

   • A. It captures traffic where IP address 10.10.10.5 is either the source or destination IP and the TCP port is 443.
   • B. Filtering occurs at the kernel driver level before packets are passed to user-space applications, reducing CPU and disk overhead.
   • C. It captures all UDP packets on port 443 as long as the source IP address is set to 10.10.10.5.
   • D. Wireshark converts this expression into a display filter at runtime after saving all interface traffic to disk.
   Show answer

   Correct: A and B. The correct answers reflect that BPF syntax "host 10.10.10.5" matches either src or dst IP, and kernel-level libpcap evaluation discards unwanted frames before user-space overhead occurs. The distractors are incorrect because the expression specifically requires TCP (not UDP), and BPF capture filters discard non-matching traffic at capture time rather than saving all interface traffic to disk for post-filtering.

3. During a performance investigation, a junior technician applies the Wireshark display filter "tcp.analysis.retransmission". What type of frames does Wireshark display when this filter is active?

   • A. Frames containing initial TCP SYN request packets sent during connection establishment.
   • B. Frames flagged by Wireshark TCP dissecting engine as sequence number retransmissions.
   • C. Frames carrying Selective Acknowledgment (SACK) blocks without sequence gaps.
   • D. Frames generated by network interface cards to acknowledge receipt of jumbo frames.
   Show answer

   Correct: B. The correct choice is that tcp.analysis.* fields are synthetic fields created by Wireshark's TCP analyzer when it detects duplicate sequence numbers. The wrong options are incorrect because initial SYN requests use tcp.flags.syn==1, SACK blocks are tracked via tcp.options.sack, and NIC acknowledgments do not generate synthetic retransmission flags unless packet loss occurs on the wire.

4. A security analyst needs to filter HTTP traffic in a packet trace to identify requests where the HTTP Host header contains the substring "techclick". Which Wireshark display filter expression should be used?

   • A. http.host contains "techclick"
   • B. http.request.uri matches "techclick"
   • C. tcp.payload == "techclick"
   • D. http.request and tcp.host == "techclick"
   Show answer

   Correct: A. The correct filter is http.host contains "techclick", as http.host evaluates the HTTP Host request header and "contains" performs a case-insensitive substring search. The alternative choices are incorrect because http.request.uri filters URI paths rather than host headers, tcp.payload == requires an exact full payload match, and tcp.host is not a valid Wireshark protocol display filter field.

5. A network engineer is analyzing a packet trace of a new TCP connection setup. What is the standard order of flags set in TCP headers during a normal 3-way handshake?

   • A. SYN → SYN/ACK → ACK
   • B. SYN → SYN → ACK
   • C. ACK → SYN → ACK
   • D. SYN → ACK → SYN
   Show answer

   Correct: A. The correct sequence is SYN sent by client, SYN/ACK replied by server, and ACK returned by client to establish connection state. The other options are incorrect because dual SYN or ACK-first sequences violate RFC 793 connection state machine specifications.

Last updated: 2026-10-19

WCNA practice test FAQ