200-201 Network Intrusion Analysis Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  tcp.stream

  Why this is correct

  tcp.stream isolates one complete TCP conversation by its stream index, letting you follow and export all payload bytes for that specific session. This satisfies the requirement to extract the full TCP data of a single conversation rather than filtering individual packets by port or address.

• ✗

  tcp.port

  Why it's wrong here

  tcp.port filters packets by TCP port number, which narrows traffic but does not reassemble or extract the complete data stream of one conversation. It is tempting because port filtering quickly isolates a service's traffic, and it would be the right choice when you only need packets matching a given port.

• ✗

  http.request

  Why it's wrong here

  http.request matches only HTTP request headers, so it discards TCP payload from other protocols and cannot reconstruct a full conversation's data. It is tempting because HTTP is the most common traffic analysts inspect, and this filter is genuinely useful when isolating HTTP requests specifically, not arbitrary TCP streams.

• ✗

  ip.addr

  Why it's wrong here

  ip.addr matches packets by IP address, capturing all traffic to or from a host rather than extracting the reassembled TCP data of a single conversation. It is tempting because address filtering is the fastest way to isolate one host's traffic, and it would be correct when you need every packet involving that IP.