LPIC-1 GNU and Unix Commands Practice Question
Exhibit
$ sudo tcpdump -i eth0 -c 5 -n listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes 10:00:00.123456 IP 192.168.1.100.12345 > 10.0.0.1.80: Flags [S], seq 123, win 65535, options [mss 1460], length 0 10:00:00.123789 IP 10.0.0.1.80 > 192.168.1.100.12345: Flags [S.], seq 456, ack 124, win 65535, options [mss 1460], length 0 10:00:00.124000 IP 192.168.1.100.12345 > 10.0.0.1.80: Flags [.], ack 457, win 65535, length 0 10:00:00.124500 IP 192.168.1.100.12345 > 10.0.0.1.80: Flags [P.], seq 124:200, ack 457, win 65535, length 76 10:00:00.125000 IP 10.0.0.1.80 > 192.168.1.100.12345: Flags [.], ack 201, win 65535, length 0
Refer to the exhibit. What type of traffic is being captured?
⚠ Common exam trap
Candidates often confuse a successful TCP handshake with an incomplete one by overlooking the final ACK, or they may misinterpret the PSH flag as application-layer protocol traffic (like FTP or DNS) without checking port numbers or protocol-specific payloads.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A successful TCP three-way handshake followed by a data transfer.
The exhibit shows a TCP three-way handshake (SYN, SYN-ACK, ACK) followed by a data transfer segment (PSH, ACK). This sequence indicates a successful connection establishment and subsequent data exchange, which matches the description of a successful TCP three-way handshake followed by data transfer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A successful TCP three-way handshake followed by a data transfer.
Why this is correct
Packets show SYN, SYN-ACK, ACK (handshake), then PUSH-ACK with data.
- ✗
An incomplete TCP handshake.
Why it's wrong here
The handshake completes with the third ACK.
- ✗
An FTP session.
Why it's wrong here
FTP uses ports 20/21, not 80.
- ✗
A DNS query and response.
Why it's wrong here
The destination port 80 indicates HTTP, not DNS (53).
Visual reference
Go deeper
Related to this question
About these practice questions
This LPIC-1 question is part of Courseiva's 527-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-1 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-1 exam.