CompTIA CASP+ (CAS-004) — Question 26

A security analyst is reviewing network connectivity on a Linux workstation and examining the active TCP connections using the command line.
Which of the following commands would be the BEST to run to view only active Internet connections?

Answer options

• A. sudo netstat -antu | grep ג€LISTENג€ | awk '{print$5}'
• B. sudo netstat -nlt -p | grep ג€ESTABLISHEDג€
• C. sudo netstat -plntu | grep -v ג€Foreign Addressג€
• D. sudo netstat -pnut -w | column -t -s \w'
• E. sudo netstat -pnut | grep -P ^tcp

Correct answer: E

Explanation

The correct answer is E because it specifically filters the output of netstat to show only TCP connections, which are active Internet connections. Option A focuses on listening ports, while B shows established connections but may not include all active TCP connections. Option C excludes 'Foreign Address', which is essential for identifying active Internet connections, and D does not specifically filter for TCP.