Question

A network technician suspects that malware on a user PC is opening multiple TCP connections to a specific foreign host address. Which Windows command line utility can be used to confirm the multiple TCP connections?

Answer 1

A network technician can use the netstat command line utility to confirm multiple TCP connections by issuing the command netstat -ano, which will list active connections along with the process IDs for further investigation.

Step-by-step explanation:

To confirm multiple TCP connections on a user's PC, the network technician can use the Windows command line utility called netstat. This utility can display a list of active connections, both incoming and outgoing. To use netstat for diagnosing potential malware activity, the technician would typically execute a command in the format of netstat -ano, which lists all the active connections and listening ports along with the process ID (PID) of each connection. If multiple connections to a suspicious foreign host address are present, they will be displayed in the list this command provides. After identifying suspicious connections, the PID can help in identifying the malicious process that needs to be further investigated in the Windows Task Manager.