2. A security operations center analyst is using the command line to display specific traffic. The analyst uses the following command: `$ tshark -r file.pcap -Y 'http or udp'`. Which of the following will the command line display?
Answer: B
The command line will display unencrypted web requests and DNS traffic.
The command `$ tshark -r file.pcap -Y 'http or udp'` filters for HTTP traffic, which is typically unencrypted, and UDP traffic, which includes various protocols such as DNS. Therefore, the output will specifically show unencrypted web requests along with DNS traffic.
A) Encrypted web requests and Domain Name System (DNS) traffic
This option is incorrect because the command specifically targets HTTP traffic, which is unencrypted unless explicitly stated as HTTPS. The presence of DNS traffic is correctly noted, but the reference to encrypted web requests makes this option invalid.
B) Unencrypted web requests and DNS traffic
This option is correct as the command filters for HTTP traffic, which is commonly unencrypted, and additionally captures UDP traffic, which includes DNS queries. This accurately reflects the expected output of the command.
C) Neither encrypted nor unencrypted web and DNS traffic
This option is incorrect since the command explicitly targets HTTP and UDP traffic. Therefore, the command will indeed display traffic, making this option invalid.
D) Both encrypted and unencrypted web and DNS traffic
This option is incorrect because, while DNS traffic is included, HTTP traffic is unencrypted, and the command does not capture encrypted web traffic (HTTPS). Thus, the assertion of both types of web traffic is misleading.
Conclusion
The correct answer is clearly option B, as it accurately describes the output of the command, which focuses on unencrypted HTTP and relevant UDP traffic, including DNS. All other options fail to correctly interpret the command's filtering criteria, leading to inaccuracies regarding the type of traffic displayed.