mediumMultiple ChoiceObjective-mapped
CISSP Practice Question: A network analyst suspects a host on the internal…
A network analyst suspects a host on the internal network is sending abnormal amounts of traffic. Which tool should be used to capture and analyze the packets?
⚠ Common exam trap
A common mix-up: candidates confuse Nmap's ability to send and receive packets for scanning with actual packet capture and analysis, but Nmap does not provide the deep packet inspection or continuous capture that Wireshark offers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Wireshark
Wireshark is the correct tool because it is a packet analyzer that captures live network traffic and provides deep inspection of individual packets, including headers and payloads. This allows the analyst to examine the abnormal traffic patterns, identify source/destination IPs, protocols, and payload content to diagnose the issue.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Wireshark
Why this is correct
Wireshark is a powerful network protocol analyzer that captures and interactively displays the contents of network packets in real-time or from saved capture files. When suspecting a host, Wireshark allows an analyst to perform deep packet inspection, revealing the exact protocols, source/destination IPs, port numbers, and even the payload data, which is critical for identifying anomalous traffic patterns, malware communication, or unauthorized data transfers originating from or destined for that specific host.
- ✗
Nmap
Why it's wrong here
Nmap (Network Mapper) is primarily a security scanner used for network discovery and auditing. It excels at identifying active hosts, open ports, services running on those ports, operating system detection, and potential vulnerabilities across a network. While Nmap can help identify what services a suspicious host is offering, it does not capture or analyze the content of the network traffic flowing to or from that host, which is essential for understanding the nature of the suspicious activity.
- ✗
Netstat
Why it's wrong here
Netstat (network statistics) is a command-line utility that displays active network connections, routing tables, interface statistics, and listening ports on a local machine. It provides a snapshot of the host's current network state, showing established connections and processes. However, Netstat does not capture or analyze the actual data packets traversing these connections, making it insufficient for detailed content analysis required to confirm or investigate the specifics of suspicious network activity.
- ✗
Traceroute
Why it's wrong here
Traceroute (or tracert on Windows) is a diagnostic tool used to display the path and measure transit delays of packets across an Internet Protocol (IP) network. It identifies the sequence of routers (hops) a packet takes to reach a destination. While useful for troubleshooting network connectivity or latency issues, Traceroute provides no insight into the type of traffic, the content of the packets, or the specific applications involved in communications from a suspected host, thus not addressing the core suspicion.
Go deeper
Related to this question
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.