CAS-003 · Question #958
A security analyst discovers what is believed to be evidence of a compromise due to a watering- note attack. After an initial review of the incident the analyst notes there is ongoing web traffic to…
The correct answer is D. tcpdump. A watering hole attack involves a malicious website that compromises visitors. The analyst has identified ongoing web traffic to the suspected malicious site, so the priority is capturing and analyzing that live network traffic to understand what data is being exfiltrated and…
Question
A security analyst discovers what is believed to be evidence of a compromise due to a watering- note attack. After an initial review of the incident the analyst notes there is ongoing web traffic to the same site. Which of the Mowing command-line tools would BEST allow the incident to be investigated?
Options
- Anc
- Bdd
- Cnetatat
- Dtcpdump
How the community answered
(46 responses)- A13% (6)
- B7% (3)
- C2% (1)
- D78% (36)
Explanation
A watering hole attack involves a malicious website that compromises visitors. The analyst has identified ongoing web traffic to the suspected malicious site, so the priority is capturing and analyzing that live network traffic to understand what data is being exfiltrated and to confirm the compromise. tcpdump is a command-line packet capture tool that can intercept and record network packets in real time, making it ideal for analyzing live traffic to and from a specific host or on a specific interface. nc (netcat) is used for creating or connecting to network sockets, not passive capture. dd is a disk imaging tool used for forensic data acquisition, not network traffic analysis. netstat shows current network connections and socket states but does not capture packet contents or payload data needed for deep traffic investigation.
Topics
Community Discussion
No community discussion yet for this question.