mediumMultiple Choice
220-1202 Practice Question: During a security incident, you need to identify…
During a security incident, you need to identify which processes are listening on specific network ports on a Windows server. Which command-line tool should you use?
⚠ Common exam trap
CompTIA often tests the distinction between commands that show network configuration (ipconfig) versus those that show active connections and listening ports (netstat), leading candidates to confuse ipconfig /all as a tool for port enumeration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
netstat -an
The `netstat -an` command displays all active TCP connections and the TCP/UDP ports on which the computer is listening, with numerical addresses and port numbers. This makes it the correct tool to identify which processes are listening on specific network ports during a security incident on a Windows server.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
nslookup
Why it's wrong here
Incorrect. nslookup queries DNS servers, it does not show listening ports.
- ✗
tracert
Why it's wrong here
Incorrect. tracert traces the route packets take to a destination, not listening ports.
- ✓
netstat -an
Why this is correct
Correct. netstat -an displays all active connections and listening ports with numerical addresses, helping identify suspicious services.
- ✗
ipconfig /all
Why it's wrong here
Incorrect. ipconfig /all shows detailed IP configuration, not port or process information.
Visual reference
Go deeper
Related to this question
About these practice questions
This 220-1202 question is part of Courseiva's 687-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.