Examkin

Soru

Zorluk: Çok zorMicrosoft Command-Line Tools

A network security administrator investigating a suspected compromised Windows 11 workstation needs to perform initial command-line triage. The administrator must view all active TCP network connections along with their numerical IP addresses and owning Process IDs (PIDs). Additionally, the administrator must purge and reload the local NetBIOS remote name cache table to remove potentially poisoned entries. Which TWO of the following command-line utility configurations should the administrator run to accomplish these tasks?

  1. netstat -anoCevap
  2. nbtstat -RCevap
  3. C
    nbtstat -r
  4. D
    netstat -r

Cevap

Executing netstat -ano to display active network connections with process IDs, and nbtstat -R to purge and reload the NetBIOS name cache.
To view active TCP connections along with numerical IP addresses and owning Process IDs (PIDs), netstat -ano is the correct command because -a displays all active connections, -n shows numerical addresses, and -o displays the PID. To purge and reload the remote NetBIOS name cache, nbtstat -R is required because the uppercase -R switch specifically flushes the cache and reloads it.

Adım Adım Çözüm

1
Identify the command utility and switch combination required to view active connections alongside PID mapping.
Running netstat -ano lists all connections (-a), formats addresses numerically (-n), and displays the owning Process ID (-o).
Security triage requires identifying which local process PID is responsible for active external sockets.
2
Identify the command utility and case-sensitive switch required to flush and reload the NetBIOS name cache.
Running nbtstat -R purges and reloads the remote NetBIOS cache table.
The uppercase -R flag specifically instructs nbtstat to purge the cache and reload entries from the LMHOSTS file.

Anahtar Kavram

Windows Command-Line Network Diagnostics and Switch Sensitivity
Bu soruyu puanla

Konular

Microsoft Command-Line Tools

Bu konudan daha fazla soru