200-201 Security Monitoring Practice Question
A security analyst is analyzing a PCAP file in Wireshark and wants to isolate all HTTPS traffic. Which display filter should the analyst use?
⚠ Common exam trap
Cisco often tests the distinction between capture filters and display filters, and the trap here is that candidates confuse the simpler capture filter syntax (`port 443`) with the required display filter syntax (`tcp.port == 443`), leading them to choose Option D.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
tcp.port == 443
The display filter `tcp.port == 443` in Wireshark captures all TCP traffic where either the source or destination port is 443, which is the default port for HTTPS. HTTPS traffic is HTTP over TLS/SSL, encapsulated in TCP, so filtering on port 443 effectively isolates all HTTPS sessions. This filter is symmetric, meaning it includes both client-to-server and server-to-client packets, ensuring complete visibility of the HTTPS conversation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
tcp.dstport == 443
Why it's wrong here
This only shows packets destined for port 443, missing source port 443 traffic.
- ✗
https
Why it's wrong here
Wireshark does not have a built-in 'https' display filter; it must be filtered by port.
- ✓
tcp.port == 443
Why this is correct
This display filter correctly filters packets with source or destination TCP port 443.
- ✗
port 443
Why it's wrong here
This is a capture filter syntax, not a display filter.
Visual reference
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 979-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.