A security analyst is diagnosing an incident in which a system was compromised from an external IP address. The socket identified on the firewall was traced to 207.46.130.0:6666. Which of the following should the security analyst do to determine if the compromised system still has an active connection?
A) tracert
B) netstat
C) ping
D) nslookup

Question

Quizplus · Accepted Answer

Netstat is a command-line tool that displays active connections, listening ports, and network statistics, which can help determine if there is still an active connection to the compromised system.

A Security Analyst Is Diagnosing an Incident in Which a System