200-201 Security Monitoring Practice Question
A security analyst is analyzing a PCAP file in Wireshark and wants to isolate all HTTPS traffic. Which display filter should the analyst use?
⚠ Common exam trap
Cisco often tests the distinction between capture filters and display filters, and the trap here is that candidates confuse the simpler capture filter syntax (`port 443`) with the required display filter syntax (`tcp.port == 443`), leading them to choose Option D.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
tcp.port == 443
The display filter `tcp.port == 443` in Wireshark captures all TCP traffic where either the source or destination port is 443, which is the default port for HTTPS. HTTPS traffic is HTTP over TLS/SSL, encapsulated in TCP, so filtering on port 443 effectively isolates all HTTPS sessions. This filter is symmetric, meaning it includes both client-to-server and server-to-client packets, ensuring complete visibility of the HTTPS conversation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
tcp.dstport == 443
Why it's wrong here
tcp.dstport == 443 matches only packets sent to port 443, excluding server-to-client responses that carry the returned HTTPS payload. It is tempting because destination port 443 identifies the service, but a bidirectional conversation needs both directions matched, which tcp.port == 443 provides.
- ✗
https
Why it's wrong here
Wireshark does not have a built-in 'https' display filter; it must be filtered by port.
- ✓
tcp.port == 443
Why this is correct
Filtering on `tcp.port == 443` matches packets where either source or destination TCP port is 443, isolating HTTPS flows regardless of direction. This satisfies the analyst's requirement to display all HTTPS traffic in the PCAP, since HTTPS conventionally runs over TCP port 443.
- ✗
port 443
Why it's wrong here
port 443 is valid BPF capture-filter syntax, not a Wireshark display filter; entered in the display bar it fails to parse. It is tempting because port 443 correctly isolates HTTPS at capture time, so it would be right in a capture filter or tcpdump expression.
Visual reference
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.