CompTIA Linux+ (XK0-005) — Question 211

A systems administrator is trying to track down a rogue process that has a TCP listener on a network interface for remote command-and-control instructions. Which of the following commands should the systems administrator use to generate a list of rogue process names? (Choose two.)

Answer options

• A. netstat -antp | grep LISTEN
• B. lsof -iTCP | grep LISTEN
• C. lsof -i:22 | grep TCP
• D. netstat -a | grep TCP
• E. nmap -p1-65535 | grep -i tcp
• F. nmap -sS 0.0.0.0/0

Correct answer: A, B

Explanation

The correct answers A and B provide commands to list processes that are actively listening for TCP connections, which is essential for identifying rogue processes. Options C, D, E, and F do not specifically filter for listening processes or do not focus on TCP, making them less effective for this task.