Which hex sequence identifies a ZIP local file header signature?

Study for the Wireshark Block 5 Exam. Prepare with flashcards and multiple choice questions, each offering hints and explanations. Ace your exam with the best resources!

Multiple Choice

Which hex sequence identifies a ZIP local file header signature?

Explanation:
The hex sequence identifies a ZIP local file header by its signature, which is the four-byte pattern 50 4B 03 04. In ASCII, those first two bytes spell “PK,” which is why ZIP files are often labeled with PK. So any sequence that begins with 50 4B 03 04 correctly marks the start of a local header. In the provided options, the one that includes that exact signature, shown either as the bytes themselves or immediately after the "PK" label, matches this identification. The other sequences correspond to different file types: 4D 5A is the MZ signature used by executables, and 89 50 4E 47 is the PNG signature. The extra bytes after the signature (such as 14 00 06 00) are simply fields that come after the signature in the ZIP local header and do not define the signature itself.

The hex sequence identifies a ZIP local file header by its signature, which is the four-byte pattern 50 4B 03 04. In ASCII, those first two bytes spell “PK,” which is why ZIP files are often labeled with PK. So any sequence that begins with 50 4B 03 04 correctly marks the start of a local header. In the provided options, the one that includes that exact signature, shown either as the bytes themselves or immediately after the "PK" label, matches this identification. The other sequences correspond to different file types: 4D 5A is the MZ signature used by executables, and 89 50 4E 47 is the PNG signature. The extra bytes after the signature (such as 14 00 06 00) are simply fields that come after the signature in the ZIP local header and do not define the signature itself.

Subscribe

Get the latest from Passetra

You can unsubscribe at any time. Read our privacy policy