200-201 Wireshark display filter Practice Question
In Wireshark, a security analyst wants to display only packets with source IP 10.0.0.1 and destination port 80. Which display filter should be used?
⚠ Common exam trap
A common trap in this question is that candidates may incorrectly assume that the `eq` operator is invalid in Wireshark display filters, but it is actually valid. However, the Cisco CyberOps curriculum typically uses the `==` operator for display filters, so option B is not the expected answer. Candidates should also be aware that options C and D use capture filter syntax, which is not suitable for the display filter bar.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ip.src == 10.0.0.1 and tcp.dstport == 80
It uses the standard display filter syntax with the `==` operator and correct field names (`ip.src` and `tcp.dstport`). Option B uses `eq`, which is a valid operator in Wireshark display filters, but the Cisco CyberOps curriculum expects the `==` operator for consistency. Therefore, option B is considered incorrect in this context. Options C and D use capture filter syntax, which is not appropriate for the Wireshark display filter bar.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
ip.src == 10.0.0.1 and tcp.dstport == 80
Why this is correct
Correct. Uses standard display filter syntax with `==`.
- ✗
ip.src eq 10.0.0.1 and tcp.dstport eq 80
Why it's wrong here
Incorrect. Although `eq` is a valid Wireshark operator, the Cisco CyberOps curriculum expects the `==` operator, so option B is not the preferred answer.
- ✗
src 10.0.0.1 and dst port 80
Why it's wrong here
Incorrect. Uses capture filter syntax (e.g., `src`, `dst`, `port`), which is not appropriate for the display filter bar.
- ✗
host 10.0.0.1 && port 80
Why it's wrong here
Incorrect. Uses capture filter syntax (`host` and `port`), not display filter syntax.
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 979-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.