An administrator suspects malware has infected a server. Which of the following should be used to check services communicating with external servers?

netstat shows real-time active network connections, including the remote endpoint addresses and port numbers for each connection. An administrator can use it to spot unexpected outbound connections to external IPs that indicate malware beaconing or data exfiltration.

arp maps IP addresses to MAC addresses on the local network segment and provides no visibility into connections made to external remote servers.

nslookup is a DNS resolution tool used to look up hostnames and records, not a utility for monitoring active network connections or sessions.

dig is also a DNS query tool that retrieves DNS records and has no capability to display or monitor active network sessions.