Wireshark WCNA Practice Exams
Last updated on Oct 21,2026- Exam Code: WCNA
- Exam Name: Wireshark Certified Network Analyst
- Certification Provider: Wireshark
- Latest update: Oct 21,2026
Refer to the exhibit.
Which statement about this HTTP packet is correct?
- A . This packet was sent from an HTTP server.
- B . The packet contains a request for a graphic file.
- C . This packet contains an invalid HTTP Request Method.
- D . This packet indicates an HTTP client is browsing www.wiresharktraining.com.
What is the most efficient method for saving non-contiguous packets in a trace file?
- A . Mark the packets and choose to save the marked packets.
- B . Apply a color filter for each packet and save all colored packets.
- C . Right click and copy the packets individually to a new instance of Wireshark.
- D . Open the packets in a new window and save them under the same file name.
Wireshark can be used to capture, reassemble and playback encrypted VoIP conversations.
- A . True
- B . FiFalse
You can identify compromised hosts that are communicating with Command and Control (C&C) servers by capturing traffic close to the network egress point and filtering on the IP addresses of the suspect C&C servers.
- A . True
- B . False
If a DHCP client does not receive an acknowledgment before the expiration of the rebinding time, the DHCP client must release its IP address and send a DHCP broadcast to locate a DHCP server or Relay Agent.
- A . True
- B . False
Which statement about the TCP recovery process is true?
- A . Packet loss recovery is always started by the client.
- B . The window size field is used in the packet loss recovery process.
- C . TCP hosts attempt three retransmissions before terminating the connection.
- D . Retransmitted packets use the same sequence number as the original lost packet.
Both sides of a TCP connection must negotiate a common receive window size value.
- A . True
- B . False
Refer to the exhibit.
Which statement about the Capture Options window shown is correct?
- A . Wireshark will resolve IP addresses to host names.
- B . Wireshark will scroll to display the most recent packet captured.
- C . Wireshark will attempt to resolve OUI values for all MAC addresses.
- D . Wireshark will automatically stop capturing packets after two files have been saved.
The capture filter port 67 would capture all DHCP traffic seen by Wireshark.
- A . True
- B . False