An analyst suspects cleartext passwords are being sent over the network. Which of the following tools would best support the analyst's investigation?

Question

Options

• AOpenVAS
• BAngry IP Scanner
• CWireshark
• DMaltego

• A
  5% (2)
• B
  15% (6)
• C
  73% (30)
• D
  7% (3)

Explanation

Wireshark is the correct tool because it is a packet/protocol analyzer (sniffer) that captures and inspects live network traffic in detail, allowing an analyst to read the actual contents of unencrypted packets - including cleartext credentials transmitted over protocols like FTP, Telnet, or HTTP. OpenVAS (A) is a vulnerability scanner used to identify security weaknesses in systems, not to capture or analyze network traffic. Angry IP Scanner (B) is a network scanning tool used to discover hosts and open ports, not to inspect packet contents. Maltego (D) is an OSINT and data visualization tool used for threat intelligence and link analysis, making it irrelevant to capturing live traffic.

Memory Tip: Think "Wire-shark bites into your network cable and reads everything flowing through it." If you need to see what's inside the packets, Wireshark is your go-to - it's the de facto standard for network traffic analysis on the CompTIA Security+ exam.

No community discussion yet for this question.