A security analyst recently read a report about a flaw in several of the organization's printer models that causes credentials to be sent over the network in cleartext, regardless of the encryption…

Question

Options

• AWireshark
• Bnetcat
• CNessus
• DNmap

• A
  80% (33)
• B
  12% (5)
• C
  5% (2)
• D
  2% (1)

Explanation

Wireshark is the right tool because it's a packet capture (PCAP) analyzer that lets you inspect actual network traffic in real time - you can see exactly what bytes are flowing between the printer and other hosts, including any plaintext credentials. If the printer is truly leaking credentials in cleartext, Wireshark will show them visibly in the captured packets, directly validating the finding.

• Netcat (B) is a raw TCP/UDP connection tool useful for port testing and data transfer, but it doesn't passively capture and decode network traffic the way Wireshark does.
• Nessus (C) is a vulnerability scanner that checks for known CVEs and misconfigurations - it might flag a related vulnerability, but it won't show you the actual cleartext credentials traversing the wire.
• Nmap (D) is a port and service scanner; it identifies open ports and running services but doesn't analyze the content of network traffic.

Memory tip: Think "Wireshark = wire + shark - it bites into the wire and shows you what's inside." Any time an exam question asks you to see or capture what's actually on the network (cleartext, credentials, packets), Wireshark is almost always the answer.

No community discussion yet for this question.