mediumMultiple ChoiceObjective-mapped
CS0-003 Practice Question: An analyst wants to capture all traffic to and…
An analyst wants to capture all traffic to and from a specific IP address for analysis. Which command-line tool is most appropriate?
⚠ Common exam trap
Candidates often confuse tools that probe or display state (nmap, netstat, iptables) with tools that capture raw traffic (tcpdump), leading them to select a tool that does not actually capture packets for analysis.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
tcpdump host 10.0.0.1
`tcpdump host 10.0.0.1` captures all packets where the source or destination IP address matches 10.0.0.1, making it the ideal tool for capturing all traffic to and from a specific IP for analysis. It operates at the packet level, using libpcap to intercept raw network frames, and the `host` filter instructs it to match both directions of traffic without additional parsing or state tracking.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
nmap -sS 10.0.0.1
Why it's wrong here
Nmap is an active network scanning tool designed for host discovery and port enumeration, not passive traffic capture. The `-sS` option specifically performs a SYN scan, which involves sending SYN packets to probe for open ports and actively attempts to establish connections. This generates new network traffic rather than observing existing or future packets flowing to and from a specified host.
- ✗
netstat -ant | grep 10.0.0.1
Why it's wrong here
Netstat is used to display network connections, routing tables, and interface statistics, providing a snapshot of current network activity. While the `-ant` flags show all active TCP connections in numerical format, it only reports on established or listening connections. It does not capture or log all individual packets, including transient, failed, or connectionless traffic like UDP datagrams or ICMP messages, to and from a host.
- ✗
iptables -L -v
Why it's wrong here
Iptables is a command-line utility for configuring the Linux kernel firewall's IP packet filter rules. The `-L -v` command lists the current firewall rules with verbose output, including packet and byte counters for each rule. This command is solely for managing and inspecting firewall policies, showing how traffic *would* be handled, not for intercepting, recording, or analyzing the content of network traffic itself.
- ✓
tcpdump host 10.0.0.1
Why this is correct
Tcpdump is a powerful command-line packet analyzer that captures and displays network traffic. The `host 10.0.0.1` filter expression precisely instructs `tcpdump` to capture all packets where the source IP address is `10.0.0.1` or the destination IP address is `10.0.0.1`. This effectively captures all inbound and outbound network traffic associated with the specified host, fulfilling the requirement to capture all traffic to and from it.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CS0-004 question from scratch — 236 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.