Match each security tool to its primary purpose.
Drag a concept onto its matching description — or click a concept then click the description.
Network scanning and enumeration
Packet analysis
Exploitation framework
Web application security testing
Intrusion detection and prevention
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Nmap: Network scanning and discovery
Nmap is for network scanning, Wireshark for protocol analysis, Metasploit for penetration testing, and Burp Suite for web application testing. Common confusions include misattributing these roles.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Nmap: Network scanning and discovery
Why this is correct
Nmap operates as a network discovery tool by crafting raw IP packets—typically SYN, ACK, ICMP, and UDP probes—to map live hosts, enumerate open TCP/UDP ports, and fingerprint operating systems and service versions via its scripting engine. It is purpose-built for reconnaissance and network inventory, not for executing exploit code or modifying application state. Because it works primarily at the IP and transport layers, its output informs an attacker or defender of attack surface but does not validate or exploit vulnerabilities.
Nmap: Web application security testing
Why it's wrong here
While Nmap includes an NSE script subset that queries HTTP endpoints (e.g., http-title, http-methods), it lacks the core functionality of a web application security testing platform: an intercepting proxy, a crawler, session handling, and HTTP message tampering. That workload belongs to Burp Suite, which positions itself between browser and server to capture and modify requests and responses, test for SQL injection, XSS, and auth flaws, and automate fuzzing. Classifying Nmap this way confuses network-layer host and service enumeration with application-layer vulnerability validation.
Wireshark: Network protocol analysis
Why this is correct
Wireshark captures packets from live interfaces using libpcap/Npcap and then decodes them with protocol dissectors covering hundreds of protocols, enabling deep inspection of headers, payloads, sequences, and retransmission patterns. It is a passive analysis tool—it does not generate traffic itself—and is used mainly for troubleshooting, network performance measurement, and examining evidence in security incidents. Its value comes from filtering and follow-stream features that reconstruct TCP sessions and extract application data for forensic review.
Wireshark: Penetration testing framework
Why it's wrong here
A pen-testing framework such as Metasploit provides an integrated environment for selecting exploits, configuring payloads, launching attacks, and maintaining session access through components like Meterpreter, msfvenom, and listener handlers. Wireshark contains none of that: it has no exploit database, no payload generator, no command-and-control listener, and no post-exploitation modules. Its role in an assessment is purely observational, capturing the traffic that other tools generate so analysts can validate and understand what occurred.
Metasploit: Penetration testing framework
Why this is correct
Metasploit is an exploitation framework that standardizes the workflow from vulnerability discovery to post-exploitation: it organizes remote exploits, payload components, encoders, and auxiliary modules under a single console (msfconsole), and it can generate shellcode with msfvenom. Its primary purpose is to demonstrate and validate exploitability in a controlled manner, giving testers interactive sessions such as Meterpreter for pivoting, privilege escalation, and collection of evidence. It is not a web app scanner or packet analyzer, though its auxiliary modules can query services that other tools identified.
Burp Suite: Web application security testing
Why this is correct
Burp Suite is an integrated platform specifically for evaluating web application security, centered around an intercepting proxy that captures HTTPS traffic between a browser and the target server and allows manual modification of requests, headers, and cookies. Core tools such as Repeater, Intruder, and Scanner support iterative fuzzing, payload-based attack testing, and automated detection of OWASP Top Ten vulnerabilities like injection, broken authentication, and access-control issues. Although it operates on HTTP(S), it does not conduct network-level port scanning or exploit remote hosts directly, distinguishing it from Nmap and Metasploit.
Go deeper
Learn chapter
SIEM Log Analysis
Key term
Analysis
In incident response, analysis is the process of examining data and events to determine what happened, how it happened, and what actions to take.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This CS0-004 question is part of Courseiva's 236-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.