ExamGecko
Question list
Search
Search

List of questions

Search

Related questions











Question 207 - XK0-005 discussion

Report
Export

A systems administrator is trying to track down a rogue process that has a TCP listener on a network interface for remote command-and-control instructions.

Which of the following commands should the systems administrator use to generate a list of rogue process names? (Select two).

A.
netstat -antp | grep LISTEN
Answers
A.
netstat -antp | grep LISTEN
B.
lsof -iTCP | grep LISTEN
Answers
B.
lsof -iTCP | grep LISTEN
C.
lsof -i:22 | grep TCP
Answers
C.
lsof -i:22 | grep TCP
D.
netstat -a | grep TCP
Answers
D.
netstat -a | grep TCP
E.
nmap -p1-65535 | grep -i tcp
Answers
E.
nmap -p1-65535 | grep -i tcp
F.
nmap -sS 0.0.0.0/0
Answers
F.
nmap -sS 0.0.0.0/0
Suggested answer: A, B

Explanation:

The best commands to use to generate a list of rogue process names that have a TCP listener on a network interface are A. netstat -antp | grep LISTEN and B. lsof -iTCP | grep LISTEN. These commands will show the process ID (PID) and name of the processes that are listening on TCP ports, which can be used to identify any suspicious or unauthorized processes. The other commands are either not specific enough, not valid, or not relevant for this task. For example:

C) lsof -i:22 | grep TCP will only show the processes that are listening on port 22, which is typically used for SSH, and not any other ports.

D) netstat -a | grep TCP will show all the TCP connections, both active and listening, but not the process names or IDs.

E) nmap -p1-65535 | grep -i tcp will scan all the TCP ports on the local host, but not show the process names or IDs.

F) nmap -sS 0.0.0.0/0 will perform a stealth scan on the entire internet, which is not only impractical, but also illegal in some countries.

asked 02/10/2024
Lazar Marinovic
34 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first