Demonstrate Familiarity with Appropriate Endpoint Tools That Gather Security Assessment Information 100-160 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security analyst is investigating a potential DNS spoofing attack. The analyst wants to see the DNS queries and responses being sent to and from the local machine in real time. Which tool should be used?

   • Aarp -a
   • Bnslookup -debug example.com
   • Ctcpdump -i any port 53
   • Dnetstat -ano | findstr :53
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A network administrator is troubleshooting a server that is sending unexpected outbound traffic. The administrator suspects a specific application is communicating with an external host on TCP port 4444. The administrator needs to capture only that traffic for analysis. Which command should be used?

   • Atcpdump -i eth0 udp port 4444
   • Btcpdump -i eth0 tcp port 4444
   • Cnetstat -an | findstr 4444
   • Dnslookup -port=4444 example.com
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A user reports that they cannot reach a specific internal application by its hostname, but they can reach it by IP address. The security team suspects a DNS issue. Which command should be used to verify the DNS resolution for that hostname?

   • Anetstat -an
   • Btcpdump -i eth0 port 80
   • Cnslookup app.internal.example.com
   • Dnetstat -r
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   A security analyst needs to quickly view the current TCP and UDP endpoints that are listening for incoming connections on a Windows workstation. Which netstat command-line option displays this information?

   • Anetstat -a
   • Bnetstat -n
   • Cnetstat -r
   • Dnetstat -s
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security analyst is investigating a Windows machine that is communicating with a known malicious domain. The analyst has already confirmed the domain resolves to 203.0.113.7. The analyst needs to determine which process on the machine is initiating the connection, but the connection is intermittent and only lasts a few seconds. Which approach is most effective?

   • ARun netstat -ano in a loop, logging output to a file, and then correlate the PID with the remote IP.
   • BUse netstat -r to check the routing table for a route to the malicious IP.
   • CUse nslookup to query the malicious domain repeatedly.
   • DRun tcpdump on the machine and capture all traffic to 203.0.113.7.
   Reveal Solution Discussion Select an answer first