CompTIA CySA+ Cybersecurity Analyst Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose D1

  The FTP-data+TCP stream would be manual work and you have to collect all information(fragmented) and reconstruct them. But the question asks how to see the entire content of downloaded files. For this reason, D from File menu selecting FTP and exporting the full content to somewhere will allow you to see the full/entire content easily. for this this reason I will choose D. I know this is a very tricky question

• Chose D1

  The correct answer is D because navigating to the File menu and selecting FTP from Export Objects allows the analyst to extract and view the actual file contents transferred during the FTP session. Option A (ftp.active.port) is not a valid display filter. Option B (tcp.port==20) might capture active FTP data but won’t extract files directly. Option C (ftp-data and follow the TCP streams) helps trace the data flow but still won’t extract full file content like the Export Objects feature does. Exporting objects is the most efficient method to see entire downloaded files in Wireshark.

• Chose D2

  In Wireshark, when dealing with FTP sessions, the control commands (such as RETR, STOR, and responses like 226 Transfer complete) are visible with the ftp filter. However, the actual file transfer data is sent over a separate data channel and is not displayed by default with just the ftp filter, as that mainly captures the control messages. To access the files transferred during the session, the analyst can go to File → Export Objects → FTP. This feature allows Wireshark to reconstruct and display any files transferred via FTP during the session, including those downloaded using RETR commands.