70-648 · Question #79
You perform a security audit of a server named CRM1. You want to build a list of all DNS requests that are initiated by the server. You install the Microsoft Network Monitor 3.0 application on CRM1…
The correct answer is D. Run the nmcap.exe /inputcapture data.cap /capture DNS /file DNSdata.capcommand. nmcap.exe /inputcapture data.cap /capture DNS /file DNSdata.cap This command will "record" the data.cap capture, applying the DNS filter to it, and save it to an output file called DNSdata.cap A display filter could be used, but !DNS will contain anything but DNS related data…
Question
You perform a security audit of a server named CRM1. You want to build a list of all DNS requests that are initiated by the server. You install the Microsoft Network Monitor 3.0 application on CRM1. You capture all local traffic on Microsoft 70-648 Exam CRM1 for 24 hours. You save the capture file as data.cap. You find that the size of the file is more than 1 GB. You need to create a file named DNSdata.cap from the existing capture file that contains only DNS related data. What should you do?
Options
- AApply the display filter !DNS and save the displayed frames as a DNSdata.capfile.
- BApply the capture filter DNS and save the displayed frames as a DNSdata.capfile.
- CAdd a new alias named DNS to the aliases table and save the file as DNSdata.cap.
- DRun the nmcap.exe /inputcapture data.cap /capture DNS /file DNSdata.capcommand.
How the community answered
(23 responses)- A9% (2)
- B9% (2)
- C4% (1)
- D78% (18)
Explanation
nmcap.exe /inputcapture data.cap /capture DNS /file DNSdata.cap This command will "record" the data.cap capture, applying the DNS filter to it, and save it to an output file called DNSdata.cap A display filter could be used, but !DNS will contain anything but DNS related data. Capture filters can only be setup before a capture is run. Aliases in Network Monitor allow friendly names to be displayed for various hosts in the capture file.
Topics
Community Discussion
No community discussion yet for this question.