Demonstrate Familiarity with Appropriate Endpoint Tools That Gather Security Assessment Information 100-160 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security analyst is investigating a Linux server that is suspected of being part of a botnet. The analyst needs to identify the process that is making outbound connections to a known command-and-control server and then capture the traffic to that server for analysis. The server has multiple users and the analyst has root access. Which approach is most effective?

   • AUse tcpdump -i eth0 port 80 to capture HTTP traffic, then use netstat -an to see connections.
   • BUse netstat -r to find the gateway, then use tcpdump -i eth0 to capture all traffic.
   • CUse nslookup to resolve the C2 domain, then use netstat -r to check the routing table.
   • DUse netstat -anp to identify the PID making the connection, then use tcpdump -i eth0 host <C2_IP> to capture the traffic.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security analyst is verifying that a company's mail server hostname resolves to the correct IP address after a recent DNS change. The analyst wants to query the authoritative DNS server directly, bypassing the local cache. Which command should be used?

   • Anslookup mail.example.com 8.8.8.8
   • Bnetstat -ano | findstr :25
   • Ctcpdump -i any port 53
   • Dping mail.example.com
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security analyst is verifying the DNS configuration of a domain after a suspected DNS hijack. The analyst needs to confirm the IP address that the domain currently resolves to and compare it against the expected value. Which command should be used?

   • Anetstat -r
   • Bnetstat -an
   • Ctcpdump -i eth0 port 53
   • Dnslookup example.com
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   An analyst is investigating a potential DNS issue and wants to see the mail exchanger (MX) records for a domain. Which nslookup command sequence is appropriate?

   • Anslookup -type=NS example.com
   • Bnslookup -type=A example.com
   • Cnslookup -type=PTR example.com
   • Dnslookup -type=MX example.com
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security analyst is responding to a suspected malware infection on a Windows server. The analyst needs to identify which process is listening on a suspicious port and then capture the traffic to that port to determine if it is malicious. The analyst has administrative privileges. Which sequence of commands is most appropriate?

   • ARun tcpdump -i eth0 port <port> first, then use netstat -ano to identify the process.
   • BRun netstat -ano to find the PID listening on the port, then run tcpdump -i any port <port> to capture the traffic.
   • CRun netstat -r to find the port, then run tcpdump -i eth0 port <port> to capture traffic.
   • DRun nslookup to resolve the port number, then run netstat -r to check the routing table.
   Reveal Solution Discussion Select an answer first