Discuss Cisco 100-160 Exam Topic 1 Question 4

You are collecting data after a suspected intrusion on the local LAN.

You need to capture incoming IP packets to a file for an investigator to analyze.

Which two tools should you use? (Choose 2.)

AWireshark

Btcpdump

CNmap

Dnetstat

Suggested Answer: A, B

The CCST Cybersecurity Study Guide specifies that both Wireshark and tcpdump are packet capture tools that can record network traffic to a file for later analysis.

'Wireshark provides a graphical interface for packet capture and analysis. Tcpdump is a command-line tool that captures packets for detailed offline review.'

(CCST Cybersecurity, Incident Handling, Network Traffic Analysis section, Cisco Networking Academy)

A is correct: Wireshark is widely used for packet capture and analysis.

B is correct: tcpdump is a CLI-based packet capture tool.

C (Nmap) is for network scanning, not packet capture.

D (netstat) displays network connections and ports but does not capture packets.

Get Premium 100-160 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

16 comments · newest first

Sabra 10 months ago

Really? I thought there were other options out there.

Amie 10 months ago

Agreed, those are the go-to tools for packet capture.

Kattie 10 months ago

Definitely Wireshark and tcpdump!

Chu 11 months ago

Wait, isn’t Nmap also useful for this?

Ben 11 months ago

No way, netstat won't capture packets like those two.

Aleisha 11 months ago

I practiced a similar question before, and I think both Wireshark and tcpdump were the answers. I hope I remember that correctly!

Rolland 11 months ago

I feel like Nmap is more for network scanning rather than capturing packets, so I don't think it fits this scenario.

Meaghan 11 months ago

I'm not entirely sure, but I remember tcpdump being mentioned in class as a command-line tool for capturing packets. It might be a good choice too.

Annamae 12 months ago

I think Wireshark is definitely one of the tools we should use since it captures packets in real-time and has a user-friendly interface.

Ilene 12 months ago

Wireshark and tcpdump are the clear winners here. They're both powerful packet capture tools that will give the investigator the data they need. Just gotta make sure to run them properly.

Bernadine 1 year ago

I'm a bit unsure about this one. I know Wireshark is a network sniffer, but I'm not sure about tcpdump. Guess I'll have to review my notes on network forensics tools.

Kimbery 1 year ago

Piece of cake! Wireshark and tcpdump are the go-to tools for packet capturing. Just make sure to save the output to a file for the investigator.

Janna 1 year ago

Hmm, I'm not too familiar with network tools like these. Wireshark and tcpdump sound like the right options, but I'll have to double-check the details.

Refugia 1 year ago

This one's easy, I've used Wireshark and tcpdump before for network analysis. Gotta capture those packets!

Chan 1 year ago

I agree with Kristofer, Wireshark is a great tool for capturing network traffic.

Kristofer 1 year ago

I think we should use Wireshark to capture incoming IP packets.

Cisco 100-160 Exam - Topic 1 Question 4 Discussion