Computer Hacking Forensic Investigator (CHFI v10) — Question 154

Rusty, a computer forensics apprentice, uses the command nbtstat `"c while analyzing the network information in a suspect system. What information is he looking for?

Answer options

• A. Contents of the network routing table
• B. Status of the network carrier
• C. Contents of the NetBIOS name cache
• D. Network connections

Correct answer: C

Explanation

The correct answer is C because the nbtstat command is specifically used to display the NetBIOS name cache, which contains the names that have been resolved to IP addresses. The other options do not relate to what nbtstat provides; A deals with routing tables, B refers to network carriers, and D pertains to network connections, none of which are part of nbtstat's functionality.