CS206 Final Term Quiz 4 2025

CS206 FINAL TERM QUIZ 4

Which of the following indicates that an encrypted connection is being closed?

A TLS handshake initiation

A DNS query response

A TCP SYN packet

A TLS Encrypted Alert

The correct answer is D: TLS Encrypted Alert.

Explanation: A TLS Encrypted Alert is sent when a TLS connection is being closed, indicating the termination of the encrypted session. This alert contains information about the reason for closure, such as a graceful shutdown or error. It is part of the TLS protocol for securely closing the connection.

In Wireshark, what symptom indicates the application has failed at the server side?

The server closes the connection immediatelyThe client does not receive any acknowledgment

The client sends a RST/ACK after almost 120 seconds

The TCP handshake fails to complete

The correct answer is C: The client sends a RST/ACK after almost 120 seconds.

Explanation: When the client sends a RST/ACK (Reset Acknowledgment) after a long delay, such as 120 seconds, it indicates that the server has not responded within a reasonable time frame, and the client is forcibly closing the connection. This often points to a server-side failure, where the server is either unresponsive or unable to handle the client's request. What type of delay is likely not felt by the end user and can be safely ignored in trace files?

Delay before a TCP SYN packet

Delay before a DNS query

Delay before a TCP RST packet

Delay before an HTTP GET request

The correct answer is B: Delay before a DNS query.

Explanation: The delay before a DNS query is typically a minor delay that occurs when resolving a domain name to an IP address. This delay is usually not significant enough to be noticeable by the end user, as DNS resolution is generally quick and does not impact the overall performance of the application. Therefore, it can often be safely ignored in trace files when analyzing network performance.

What does a client use to determine the round trip time between hosts during the TCP handshake?

The time between the SYN/ACK and FIN packets

The time between the FIN and ACK packets

The time between the SYN/ACK and PSH packets

The time between the SYN and SYN/ACK packets The correct answer is D: The time between the SYN and SYN/ACK packets.

Explanation: During the TCP handshake, the client sends a SYN packet to initiate the connection, and the server responds with a SYN/ACK packet. The time it takes for the SYN packet to reach the server and the SYN/ACK packet to return to the client gives an estimate of the round trip time (RTT) between the hosts. This RTT is crucial for understanding network latency and optimizing data transfer.

In the context of a TCP handshake, SYN/ACK packet is used for

To request retransmission of lost packets

To acknowledge receipt of the SYN packet

To terminate the connection

To initiate data transfer

The correct answer is B: To acknowledge receipt of the SYN packet.

Explanation: In the TCP handshake, when a client sends a SYN packet to initiate the connection, the server responds with a SYN/ACK packet. The SYN/ACK packet serves to acknowledge the receipt of the client's SYN packet and also to indicate that the server is willing to establish a connection. This is part of the three-way handshake process in TCP.

Total Marks: 1Which file will be used to detect delays in UDP Conversations in Wire shark?

Select the correct optiontr-winsize.pcapngtr-general.pcapngtr-voip-extensions.pcapngNone of given

The correct answer is C: tr-voip-extensions.pcapng.

Explanation: In Wireshark, the tr-voip-extensions.pcapng file is commonly used to detect delays in UDP conversations, particularly in Voice over IP (VoIP) traffic. This file