Wireshark WCNA Practice Exams
Last updated on Oct 21,2026- Exam Code: WCNA
- Exam Name: Wireshark Certified Network Analyst
- Certification Provider: Wireshark
- Latest update: Oct 21,2026
You will only see the TCP Urgent Pointer field if the URG bit is set to 1 in a TCP packet.
- A . True
- B . False
TCP data is sequenced and acknowledged to ensure delivery.
- A . True
- B . False
Refer to the exhibit.
This packet was sent from an HTTP client.
- A . True
- B . False
When you apply a display filter, the Status Bar indicates the total number of packets captured and the packets displayed.
- A . True
- B . False
What is the maximum MAC Service Data Unit (MSDU) size defined by the IEEE 802.11 specification?
- A . 1518 bytes
- B . 2304 bytes
- C . 2312 bytes
- D . 4096 bytes
Refer to the exhibit.
Which statement about this traffic is correct?
- A . This is a TCP port scan.
- B . The SYN packets are sent from a single source port number.
- C . The responses to the SYN packets should only have the RST bit set.
- D . A firewall is blocking the SYN packets from reaching the desired host.
Which transport is used for multicast and broadcast traffic?
- A . TCP
- B . UDP
- C . ICMP
- D . ARP
You are analyzing network traffic, but you only see ARP queries – you do not see any ARP responses.
What could cause this situation?
- A . Wireshark is not running in monitor mode.
- B . You have applied an ip filter to the traffic.
- C . You are filtering on IP addresses for another network.
- D . You are connected to a switch port that is not spanned.
You are analyzing network traffic, but you only see ARP queries – you do not see any ARP responses.
What could cause this situation?
- A . Wireshark is not running in monitor mode.
- B . You have applied an ip filter to the traffic.
- C . You are filtering on IP addresses for another network.
- D . You are connected to a switch port that is not spanned.
Promiscuous mode and monitor mode offer the same functionality.
- A . True
- B . False