Exam CS0-003 topic 1 question 111 discussion

Actual exam question from CompTIA's CS0-003

Question #: 111
Topic #: 1

A systems administrator receives reports of an internet-accessible Linux server that is running very sluggishly. The administrator examines the server, sees a high amount of memory utilization, and suspects a DoS attack related to half-open TCP sessions consuming memory. Which of the following tools would best help to prove whether this server was experiencing this behavior?

A. Nmap
B. TCPDump
C. SIEM
D. EDR

Show Suggested Answer

Suggested Answer: B 🗳️

by kmordalv at Aug. 30, 2023, 4:08 p.m.

Comments

Submit Cancel

kmordalv

Highly Voted 8 months, 2 weeks ago

Selected Answer: B

Correct In this scenario, where the administrator suspects a DoS attack related to half-open TCP sessions consuming memory, TCPDump would be the best tool to use. It can help prove whether the server is experiencing this behavior by capturing and analyzing the network packets to identify patterns consistent with half-open TCP sessions.

upvoted 15 times

...

[Removed]

Highly Voted 5 months, 2 weeks ago

Selected Answer: B

B) TCPDump This allows you to inspect packets and view the TCP flags for suspicious activity. Hans IT Academy on YouTube has a good video that briefly touches on this topic. Video #10 of his playlist, title is "Network-related threat indicators"

upvoted 7 times

...

chaddman

Most Recent 6 months, 1 week ago

TCPDump (B): TCPDump allows the capture and analysis of network traffic. The administrator can use it to examine the state of incoming TCP connections in real-time, making it a suitable tool for diagnosing issues related to half-open TCP sessions.

upvoted 5 times

...

Exam CS0-003 All Questions

View all questions & answers for the CS0-003 exam

Exam CS0-003 topic 1 question 111 discussion

Comments

kmordalv

[Removed]

chaddman

SY0-701