A security analyst is responding to a potential malware infection on a Linux server. The analyst needs to identify which network connections are currently established to external IP addresses and then capture the actual data being sent over those connections for deeper inspection. Which two commands, used together, best accomplish this?

netstat -an followed by tcpdump -i eth0

tcpdump -i eth0 followed by nslookup

nslookup followed by netstat -r

netstat -r followed by tcpdump -i eth0 port 53

A security analyst is investigating a Windows machine that is beaconing to a domain that is known to be malicious. The analyst has already confirmed that the domain resolves to 203.0.113.5. The analyst needs to identify the process responsible for the beaconing, but the connection is short-lived and appears only every few minutes. Which approach is most effective?

Run a script that repeatedly executes netstat -ano and logs the output, then search for 203.0.113.5.

Use nslookup to query the malicious domain repeatedly.

Use netstat -r to check the routing table for a route to the malicious IP.

Run tcpdump on the machine and capture all traffic to 203.0.113.5.

CiscoCertified Support Technician (CCST) Cybersecurity

Domain 3Objective 2

Demonstrate Familiarity with Appropriate Endpoint Tools That Gather Security Assessment Information 100-160 Practice Questions (Page 6)

Part of the Endpoint Security Concepts domain, which makes up ~25% of our current practice bank. Cisco does not publish an official question count, but from its 50-minute exam (~20–35 total, ~5–9 in this domain), expect 1–2 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

3concepts

Questions 26–30

26application · medium
A network administrator is troubleshooting a connectivity issue between two servers. The administrator suspects that packets are being dropped by a firewall. Which command should be used to capture traffic on the interface to see if packets are arriving?
Select an answer first
27application · medium
A security analyst is responding to a potential malware infection on a Linux server. The analyst needs to identify which network connections are currently established to external IP addresses and then capture the actual data being sent over those connections for deeper inspection. Which two commands, used together, best accomplish this?
Select an answer first
28application · medium
A security analyst is monitoring a network for signs of DNS tunneling. The analyst needs to capture DNS queries and responses to analyze the length and frequency of queries. Which command should be used?
Select an answer first
29expert · hard
A security analyst is investigating a Windows machine that is beaconing to a domain that is known to be malicious. The analyst has already confirmed that the domain resolves to 203.0.113.5. The analyst needs to identify the process responsible for the beaconing, but the connection is short-lived and appears only every few minutes. Which approach is most effective?
Select an answer first
30application · medium
A security analyst is investigating a Windows workstation that is making unexpected connections to multiple external IP addresses. The analyst needs to see the list of established connections and the associated process names. Which command should be used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 100-160

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “100-160” is a trademark of its owner, used for identification only.

Demonstrate Familiarity with Appropriate Endpoint Tools That Gather Security Assessment Information 100-160 Practice Questions (Page 6)

Questions 26–30

A network administrator is troubleshooting a connectivity issue between two servers. The administrator suspects that packets are being dropped by a firewall. Which command should be used to capture traffic on the interface to see if packets are arriving?

A security analyst is monitoring a network for signs of DNS tunneling. The analyst needs to capture DNS queries and responses to analyze the length and frequency of queries. Which command should be used?

A security analyst is investigating a Windows workstation that is making unexpected connections to multiple external IP addresses. The analyst needs to see the list of established connections and the associated process names. Which command should be used?

Keep studying — Endpoint Security Concepts