What system details can an investigator obtain from the NetBIOS name table cache?

The correct answer is C. List of connections made to other systems. The NetBIOS name table cache (viewable with 'nbtstat -c') stores recently resolved remote NetBIOS names and their corresponding IP addresses. This cache reveals which remote systems the local machine has recently communicated with, effectively showing a list of connections made…

Submitted by rania.sa· Apr 18, 2026Network Forensics

Question

Options

AList of files opened on other systems
BList of the system present on a router
CList of connections made to other systems
DList of files shared between the connected systems

How the community answered

(65 responses)

A
3% (2)
B
2% (1)
C
89% (58)
D
6% (4)

Explanation

The NetBIOS name table cache (viewable with 'nbtstat -c') stores recently resolved remote NetBIOS names and their corresponding IP addresses. This cache reveals which remote systems the local machine has recently communicated with, effectively showing a list of connections made to other systems. It does not list files opened on other systems (that would require session-level inspection), systems present on a router (that requires ARP/routing tables), or shared files between connected systems (that requires share enumeration tools).

Topics

#NetBIOS#Network Artifacts#Name Resolution#System Cache

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice