A security operations center analyst is using the command line to display specific traffic.

The -r file.pcap argument instructs TShark to read packets from the specified capture file, while -Y applies a Wireshark display filter . The expression "http or udp" therefore displays packets recognized as HTTP or packets using UDP.

Traditional HTTP traffic is unencrypted and can be dissected directly as HTTP. HTTPS normally carries HTTP inside TLS encryption and therefore is not displayed merely because the filter specifies http. DNS commonly operates over UDP, particularly for standard queries and responses, so ordinary DNS traffic satisfies the udp portion of the expression. Consequently, B is the best answer in the context of the available choices.

A technical distinction is important: the expression does not mean “HTTP or DNS specifically.” The udp portion matches UDP traffic generally, which can include protocols other than DNS. Nevertheless, within the examination scenario, the intended comparison is plaintext HTTP versus encrypted HTTPS together with standard UDP-based DNS.

Wireshark's documentation distinguishes display filters from capture filters, and TShark is the command-line network traffic analyzer within the Wireshark suite. CS0-004 places packet-analysis capabilities within Security Operations.

Study Guide Reference: Security Operations → Packet Analysis → Wireshark/TShark → PCAP Analysis → Display Filters → HTTP, UDP, and DNS.