Wireshark WCNA Practice Exams
Last updated on Oct 21,2026- Exam Code: WCNA
- Exam Name: Wireshark Certified Network Analyst
- Certification Provider: Wireshark
- Latest update: Oct 21,2026
Which display filter is used to display all DHCP traffic?
- A . dhcp
- B . bootp
- C . tcp.port==68
- D . udp.dst.port==67
1O Graphs support display filters and expressions.
- A . True
- B . False
You may need to capture traffic at different points on the network to identify the location of packet loss.
- A . True
- B . False
Which statement about TCP sequence and acknowledgment numbering is correct?
- A . The sequence number always increments by 1 for each data packet transmitted.
- B . Both sides of a TCP connection must agree on an Initial Sequence Number value.
- C . Starting Sequence Numbers cannot be larger than 65,535 because this is a 2-byte field.
- D . The Acknowledgment Number field indicates the next sequence number expected from the other side of the connection.
Which statement about ICMP is true?
- A . Port filtering can block ICMP traffic.
- B . ICMP packets cannot cross a router.
- C . All ICMP packets are the same length.
- D . ICMP packets do not contain a UDP or TCP header.
How do you quickly spot large gaps in time between packets in a trace file containing 6,000 packets?
- A . Open and examine Wireshark’s Expert Infos window.
- B . Look for packets colorized based on Wireshark’s default coloring rule for high delta times.
- C . Set the Time column to Seconds Since Beginning of Capture and scroll through the trace file.
- D . Set the Time column to Seconds Since Previously Displayed Packet and sort the Time column.
Both the capture and display filter syntax for ARP requests and replies is arp.
- A . True
- B . False
A host has just booted up. This host is allowed to send ARP queries for the MAC address of the local DNS server before sending gratuitous ARPs to test for duplicate IP addresses on the network.
- A . True
- B . False
Null scans use legal TCP packet formats, but listen for illegally-formed TCP response packets.
- A . True
- B . False
Refer to the exhibit.
Which statement about this Wireshark image is correct?
- A . This is a live capture process.
- B . This trace file is part of a trace file set.
- C . A display filter has been applied to this traffic.
- D . These packets have been saved to a trace file already.