Security Monitoring →easyMultiple ChoiceObjective-mapped

200-201 Security Monitoring Practice Question

Which Wireshark display filter would an analyst use to view only HTTP packets that contain the word 'password' in the packet payload?

⚠ Common exam trap

Cisco often tests the distinction between protocol-specific fields (like `http.request.uri`) and the generic protocol tree (`http`), tricking candidates into choosing a filter that is too narrow (B) or too broad (D) instead of the precise `http contains` filter that searches the entire HTTP payload.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

http contains "password"

The `http contains "password"` display filter instructs Wireshark to match any HTTP packet whose payload includes the literal string 'password'. The `contains` operator performs a case-sensitive substring search across the entire HTTP protocol data (headers and body), which is exactly what an analyst needs to locate credentials or sensitive terms in HTTP traffic.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
http contains "password"
Why this is correct
The 'http contains' filter searches all HTTP fields and payload for the string.
✗
http.request.uri contains "password"
Why it's wrong here
This only checks the URI, not the full payload (e.g., POST data).
✗
data contains "password"
Why it's wrong here
The 'data' filter looks at raw data, but not specifically HTTP packets.
✗
tcp.port == 80 and frame contains "password"
Why it's wrong here
This filter checks the entire frame, not just HTTP payload, and may include false positives.

Go deeper

200-201 Security Monitoring Practice Question

Why each option matters

Option-by-option breakdown

Related to this question