Exam SY0-501 topic 1 question 260 discussion

Enjoy your word play exam masquerading as one on cyber security. Thanks CompTIA, you're the best.

Shouldn't this be Packet analyzer ?

people see the answer provided and start thinking of ways to defend it instead of thinking what the question is and what the closest answer is - D

netstat -ao

D is the answer. Nestat shows only what is the established connections between source and .destination,mostly TCP.

network traffic..netstat? no no my dear...netsta will give you the IP's, ports and state of the connections but won't help you decipher network traffic..wireshark (protocol analyzer)

tricky question.. again... I believe the answer is C under the question context. It mention "multiple connections" how can we "decipher the network traffic" to discover what are those "multiple connections"

NESTAT is probably the right answer. This seems like one of those typical Comptia questions whose aim is to confuse, however, the key to the answer is this: "and noticed multiple connections from an internal host" while she was monitoring. So the main question is to get information about a host and not the IDS she was monitoring. In order to get that information, NETSTAT seems like the best option, since she will have to run it on the particular host

Answer the question, not the previous sentence. They provide information that she noticed multiple connections, and then they ASK how to decipher network traffic.

C. NETSTAT show current connection status/info

With IDS she was already able to confirm multiple connections. You will run netstat on the source node but cannot decipher network traffic. Has to be protocol analyzer

Answer is D. The question specifically asks for the examination of network traffic, not connections. If we run netstat we will get I formation about open connections, but will get no information on the traffic or it’s contents. Connections = netstat Traffic = packet analyser

Don't let the " decipher the network traffic" get you. a callback domain is not a full url, but a domain name, IP address or hostname: localhost. Hence, Ann needs netstat command to figure things out first. The fact that it is a suspicious callback not necessary means that it is malicious. It might just be an external site processing a payment.

C. NETSTAT. Does she need to analyze the CONTENTS (packets) of the network traffic or the incoming and outgoing connections and routing? The question doesn't indicate that she wants to see the contents of the traffic, so she doesn't need a packet analyazer.

Netstat analyses network connections, and a packet analyser analyses network traffic. As Ann wants to decipher network traffic, D is the correct answer.

I suppose the keyword here is 'connections' which implies TCP. netstat would be a valid answer.

D. The keyword is decipher. The normal meaning of decipher is decrypt. Maybe "analyze" was the intent of the question. But cipher implies encrypted. Synonyms for decipher: decode, decrypt, decipher(verb) convert code into ordinary language. Synonyms: decrypt, decode, trace.