100-160 Question 130
Select 3A network administrator suspects that a host in the network is attempting to make suspicious outbound connections to various IP addresses on the internet. Which combination of tools would help the administrator identify the process making these connections and verify the DNS resolution of the destination IP addresses?
- A
netstat
- B
nslookup
- C
ping
- D
tcpdump
- E
traceroute
Show answer and explanation
Correct answers: A, B, D
Explanation
To investigate suspicious outbound connections, the administrator needs tools to identify active connections and the processes involved (netstat), verify the DNS resolution of the destination IPs (nslookup), and analyze the traffic at a packet level (tcpdump). These tools together provide the necessary insights to understand and potentially mitigate the issue.
- A. Correct.
netstat can display active connections and the processes associated with them, making it useful for identifying the program initiating the suspicious connections.
- B. Correct.
nslookup is used to verify DNS resolution, which is useful for identifying the domain names associated with the destination IP addresses.
- C. Incorrect.
ping is primarily used to test connectivity to a host but does not provide detailed information about connections or DNS resolution, making it less relevant in this scenario.
- D. Correct.
tcpdump is a packet analysis tool that can capture and inspect network traffic, allowing for a detailed examination of the suspicious connections.
- E. Incorrect.
traceroute is primarily used to trace the path packets take to reach a destination, but it doesn't provide detailed information about processes or DNS resolution.