312-49 · Question #599
Rusty, a computer forensics apprentice, uses the command nbtstat 璫 while analyzing the network information in a suspect system. What information is he looking for?
The correct answer is C. Contents of the NetBIOS name cache. The question asks what specific network information the nbtstat -c command retrieves on a suspect system.
Question
Rusty, a computer forensics apprentice, uses the command nbtstat 璫 while analyzing the network information in a suspect system. What information is he looking for?
Options
- AContents of the network routing table
- BStatus of the network carrier
- CContents of the NetBIOS name cache
- DNetwork connections
How the community answered
(14 responses)- A7% (1)
- C86% (12)
- D7% (1)
Why each option
The question asks what specific network information the `nbtstat -c` command retrieves on a suspect system.
The `route print` command or `netstat -r` displays the network routing table, not `nbtstat -c`.
The status of a network carrier is typically not directly obtainable through standard command-line tools like `nbtstat`.
The `nbtstat -c` command specifically displays the contents of the NetBIOS name cache, which lists NetBIOS names and their resolved IP addresses for remote computers.
The `netstat` command (without `-c`) is used to display active network connections, not `nbtstat -c`.
Concept tested: `nbtstat` command (NetBIOS cache)
Source: https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/nbtstat
Topics
Community Discussion
No community discussion yet for this question.