easyMultiple Choice
CS0-003 Practice Question: An analyst runs a command to check active network…
An analyst runs a command to check active network connections on a Linux host and sees many ESTABLISHED connections to an external IP on port 443. Which command was most likely used?
⚠ Common exam trap
The CS0-004 exam often tests the distinction between commands that *show* current connections (like `netstat`) versus commands that *probe* or *capture* network traffic (like `nmap` or `tcpdump`), leading candidates to confuse scanning tools with monitoring tools.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
netstat -anp
The `netstat -anp` command displays all active network connections (`-a`), shows numeric addresses and port numbers (`-n`), and includes the process ID and program name (`-p`). This makes it the correct tool for an analyst to quickly identify established TCP connections to an external IP on port 443, as it directly lists the state (ESTABLISHED), remote address, and associated process.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
netstat -anp
Why this is correct
netstat -anp lists all sockets numerically (-n), showing every connection state including ESTABLISHED (-a) and the owning process (-p). This matches the observed output of many established connections to an external IP on port 443.
- ✗
ipconfig /all
Why it's wrong here
ipconfig /all is a Windows-only utility that reports local interface configuration, not active connections, so it cannot display ESTABLISHED sessions on a Linux host. It is tempting because it does reveal IP addressing and adapter details, and would be the right choice when troubleshooting Windows interface configuration rather than enumerating Linux sockets.
- ✗
nmap -sT
Why it's wrong here
`nmap -sT` performs a TCP connect scan, probing ports to discover which are open rather than listing existing sockets, so it cannot display ESTABLISHED connections. It is tempting because it does enumerate TCP ports, and would be the right choice when mapping open services on a target host during reconnaissance.
- ✗
tcpdump -i eth0
Why it's wrong here
tcpdump captures raw packets on an interface, so it would not present a tabular list of ESTABLISHED connections with states. It is tempting because tcpdump does inspect port 443 traffic, and would be the right choice for capturing packet contents during forensic analysis or troubleshooting, rather than enumerating socket states.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CS0-004 question from scratch — 701 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.