CS0-003 Security Operations Practice Question

Which tool would best allow a security analyst to capture and analyze packets in real time to investigate a network anomaly?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Wireshark

Wireshark is a network protocol analyzer that captures and inspects packets in real time, making it ideal for real-time traffic analysis.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Metasploit
Why it's wrong here
Metasploit is a penetration testing and exploitation framework used to discover, exploit, and validate vulnerabilities on target systems. While it can deliver payloads and establish remote sessions, it lacks the native capability to capture, decode, and analyze raw network packets flowing across an interface.
✓
Wireshark
Why this is correct
Wireshark is a premier open-source packet analyzer that intercepts and decodes network traffic in real time. It allows security analysts to capture raw frames from a network interface card in promiscuous mode, filter traffic using display filters, and perform deep packet inspection to troubleshoot anomalies or detect malicious payloads.
✗
Nmap
Why it's wrong here
Nmap is an active reconnaissance tool designed for host discovery, port scanning, and service version detection. Although it generates network traffic to probe targets and analyze their responses, it is not designed to act as a passive sniffer or capture arbitrary network packets for offline analysis.
✗
Nikto
Why it's wrong here
Nikto is an open-source web server scanner that performs rapid testing against web servers to identify dangerous files, outdated software, and specific configuration vulnerabilities. It operates at the application layer to audit HTTP/HTTPS services and does not possess packet-sniffing capabilities to capture raw network traffic.

Go deeper