Exam CS0-003 topic 1 question 111 discussion

Actual exam question from CompTIA's CS0-003

Question #: 111
Topic #: 1

A systems administrator receives reports of an internet-accessible Linux server that is running very sluggishly. The administrator examines the server, sees a high amount of memory utilization, and suspects a DoS attack related to half-open TCP sessions consuming memory. Which of the following tools would best help to prove whether this server was experiencing this behavior?

A. Nmap
B. TCPDump
C. SIEM
D. EDR

Show Suggested Answer

Suggested Answer: B 🗳️

by kmordalv at Aug. 30, 2023, 4:08 p.m.

Comments

Submit Cancel

kmordalv

Highly Voted 11 months, 3 weeks ago

Selected Answer: B

Correct In this scenario, where the administrator suspects a DoS attack related to half-open TCP sessions consuming memory, TCPDump would be the best tool to use. It can help prove whether the server is experiencing this behavior by capturing and analyzing the network packets to identify patterns consistent with half-open TCP sessions.

upvoted 17 times

...

chaddman

Highly Voted 9 months, 3 weeks ago

TCPDump (B): TCPDump allows the capture and analysis of network traffic. The administrator can use it to examine the state of incoming TCP connections in real-time, making it a suitable tool for diagnosing issues related to half-open TCP sessions.

upvoted 6 times

...