SY0-501 · Question #27
A Security analyst is diagnosing an incident in which a system was compromised from an external IP address. The socket identified on the firewall was traced to 207.46.130.6666. Which of the…
The correct answer is B. netstat. The security analyst needs to identify if a compromised system maintains an active network connection to a suspicious external IP address.
Question
A Security analyst is diagnosing an incident in which a system was compromised from an external IP address. The socket identified on the firewall was traced to 207.46.130.6666. Which of the following should the security analyst do to determine if the compromised system still has an active connection?
Options
- Atracert
- Bnetstat
- CPing
- Dnslookup
How the community answered
(46 responses)- A2% (1)
- B78% (36)
- C9% (4)
- D11% (5)
Why each option
The security analyst needs to identify if a compromised system maintains an active network connection to a suspicious external IP address.
`tracert` is used to trace the path packets take to a destination, not to list active network connections on a local system.
The `netstat` command displays active TCP connections, listening ports, and various other network statistics on a local system. By running `netstat`, the analyst can determine if an `ESTABLISHED` connection exists from the compromised system to the identified external IP 207.46.130.6666, confirming an active compromise.
`Ping` is used to test the reachability of a host and measure latency, but it does not reveal active session states or connections between two hosts.
`nslookup` is used for querying DNS to resolve domain names to IP addresses or vice versa, not for displaying active network connections.
Concept tested: Monitoring active network connections using `netstat`.
Source: https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/netstat
Topics
Community Discussion
No community discussion yet for this question.