SY0-501 · Question #435
A cybersecurity analyst is looking into the payload of a random packet capture file that was selected for analysis. The analyst notices that an internal host had a socket established with another…
The correct answer is C. nc -1 192.168.5.1 -p 9856. The nc (netcat) command establishes a network socket, and in this case, it was used to connect to another internal host on a non-standard port as observed in the packet capture.
Question
A cybersecurity analyst is looking into the payload of a random packet capture file that was selected for analysis. The analyst notices that an internal host had a socket established with another internal host over a non-standard port. Upon investigation, the origin host that initiated the socket shows this output:
usera@host>history mkdir /local/usr/bin/somedirectory nc -1 192.168.5.1 -p 9856 ping -c 30 8.8.8.8 -a 600 rm /etc/dir2/somefile rm -rm /etc/dir2/ traceroute 8.8.8.8 pakill pid 9487 usera@host> Given the above output, which of the following commands would have established the questionable socket?
Options
- Atraceroute 8.8.8.8
- Bping -1 30 8.8.8.8 -a 600
- Cnc -1 192.168.5.1 -p 9856
- Dpskill pid 9487
How the community answered
(63 responses)- A10% (6)
- B3% (2)
- C81% (51)
- D6% (4)
Why each option
The `nc` (netcat) command establishes a network socket, and in this case, it was used to connect to another internal host on a non-standard port as observed in the packet capture.
The `traceroute 8.8.8.8` command is used to display the path and measure transit delays of packets across an Internet Protocol (IP) network; it does not establish a continuous data socket.
The `ping -c 30 8.8.8.8 -a 600` command sends ICMP echo request packets to a host to test connectivity and measure round-trip time, but it does not establish a persistent TCP or UDP socket for data transfer.
The `nc -1 192.168.5.1 -p 9856` command uses Netcat to initiate a connection (establish a socket) to the IP address 192.168.5.1 on TCP port 9856. This directly matches the description of an internal host establishing a socket with another internal host over a non-standard port (9856 is not a standard well-known port).
The `pakill pid 9487` command (likely a typo for `pkill`) is used to terminate processes by their process ID (PID) or name; it does not establish a network socket.
Concept tested: Netcat (nc) command usage for network connections
Source: https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/netcat
Topics
Community Discussion
No community discussion yet for this question.