Wireshark WCNA Practice Exams
Last updated on Oct 21,2026- Exam Code: WCNA
- Exam Name: Wireshark Certified Network Analyst
- Certification Provider: Wireshark
- Latest update: Oct 21,2026
The ip.addr != 10.2.4.1 display filter shows all packets except ones that contain the address 10.2.4.1 in the source or destination IP address fields.
- A . True
- B . False
How do you determine which Profile is in use while you are capturing traffic?
- A . Examine the Wireshark Title Bar.
- B . Look in the Status Bar Profile column.
- C . Right-click on the Packet Summary pane.
- D . Open the Preferences | Interface information.
Which traffic characteristic is often seen when analyzing database applications that transfer
individual records across the network?
- A . small packet sizes
- B . multicast responses
- C . large delays between transmissions
- D . separate connections for each record
The capture filter syntax for all FTP command and data channel traffic is tcp port 21.
- A . True
- B . False
A TCP Acknowledgment Number field that is never incremented by a host after the TCP handshake indicates that no data is being received by that host.
- A . True
- B . False
You can force Wireshark to temporarily dissect traffic to and from port 18067 as IRC traffic using the Decode As function.
- A . True
- B . False
Which function provides host name-to-IP address resolution services?
- A . ARP
- B . DNS
- C . ICMP
- D . SNMP
With a few exceptions, display filters use the same syntax as capture filters.
- A . True
- B . False