easyMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester wants to quickly identify…
A penetration tester wants to quickly identify the listening services on a target Linux server without performing a full port scan. The tester has obtained an unauthenticated shell as a low-privileged user. Which built-in command is most likely available on a modern Linux distribution to list all listening TCP sockets?
⚠ Common exam trap
Watch out — candidates often assume `netstat` is universally available on Linux, but the PT0-002 exam tests awareness of modern tooling deprecation, where `ss` is the default built-in command on distributions like CentOS 7+ and Ubuntu 16.04+.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ss -tlnp
`ss -tlnp` is the modern replacement for `netstat` on Linux distributions that have deprecated `netstat` (e.g., RHEL 7+, Ubuntu 16.04+). It uses the `netlink` interface to read socket information directly from the kernel, making it faster and more reliable than parsing `/proc/net/tcp`. The flags `-t` (TCP), `-l` (listening), `-n` (numeric addresses/ports), and `-p` (show process) precisely list all listening TCP sockets without requiring root privileges for basic socket listing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
netstat -tlnp
Why it's wrong here
netstat -tlnp can display listening TCP sockets with numeric addresses and process IDs, but modern minimal Linux distributions often omit netstat in favor of iproute2. Additionally, the -p flag only reveals process names when run as root; an unprivileged user will simply not get that column, making it a less dependable choice for a quick listening-port check compared to ss.
- ✓
ss -tlnp
Why this is correct
ss is the standard socket statistics utility in iproute2 and is almost always preinstalled on current Linux systems. The flags -t (TCP), -l (listening), -n (numeric), and -p (process) together precisely list listening TCP ports with numeric addresses and, when permitted, the owning process/PID. Because ss reads kernel socket information via netlink, it returns live results instantly and is the modern replacement for netstat.
- ✗
lsof -i
Why it's wrong here
lsof -i is designed to list all network files — including established connections, listening sockets, and other network-related descriptors — rather than being focused solely on listeners. Its output is verbose, and without root privileges it cannot display complete process information for all users, so filtering to find listening services is slower and less efficient than using a dedicated tool like ss.
- ✗
ifconfig -a
Why it's wrong here
ifconfig -a is a network interface configuration utility that shows interface parameters such as IP addresses, MAC addresses, MTU, and link state. It does not read the kernel's socket tables and therefore reveals nothing about TCP or UDP listening ports. Using ifconfig to identify listening services is a fundamental tool mismatch — it answers a completely different question about local networking.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PT0-003 question from scratch — 185 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.