Question Q-5829 When using Wireshark to troubleshoot a slow web application, which…
1 comment · last active Jun 3, 2026
CompTIA Network+ - Network Troubleshooting Tools
By Jordan Blake · Updated Jul 10, 2026
| Questions | 19 |
| Passing Score | 75% |
| Format | 53% Multiple Choice |
| Sessions Logged | 555 |
| Your progress | Log in / Register to track times taken, best score, questions mastered, and coverage on this quiz. |
| Rating |
Topics covered
Uncategorized19 questions
Discussion
Log in to post a comment, reply, or expand a question.
netstat shows connections/listening ports — pair with Task Manager to find owning process.
nslookup/dig for DNS — if nslookup fails but ping IP works, suspect DNS not routing.
tracert/traceroute shows each hop RTT — great for finding where latency spikes.
Packet capture sees retransmits, TLS issues, malformed packets — ping only says up/down.
ipconfig on Windows, ifconfig/ip on Linux. Default gateway wrong = can't leave subnet.
+1 votes
nmap discovers hosts/ports/services — SYN scan is stealthier than full TCP connect.
+1 votes
ping tests ICMP reachability — doesn't mean the app works (firewall can block ICMP but allow HTTPS).
Question catalog for this preview
Catalog listing of the 5 preview questions for this quiz.
Question 1
?? Multiple Choice (Hard)
When running "netstat -an" and observing a LISTENING TCP port you don't recognize, what is your next troubleshooting step?
Explanation
netstat -anb (Windows admin) or ss -tulnp (Linux) shows the process (PID and name) bound to each port. Then use: Task Manager / ps aux to see full process details; check process hash against VirusTotal; verify with vendor if it's a known legitimate service. If confirmed malicious: isolate the system, document, follow incident response procedures.
Question 2
?? True/False (Hard)
A protocol analyzer (like Wireshark) placed between two network devices can detect a man-in-the-middle attack in progress by revealing unexpected certificate changes.
Explanation
A packet capture can reveal MITM indicators: unexpected certificate serial numbers or issuer chains, certificate validity period mismatches, or encrypted traffic using unexpected cipher suites. HTTP traffic shows cleartext credential theft directly. IDS/IPS systems and SIEM tools automate this detection. Certificate pinning in applications prevents MITM even when CAs are compromised.
Question 3
?? True/False (Easy)
The traceroute (tracert in Windows) command shows the path packets take to reach a destination and the delay at each hop.
Explanation
Traceroute works by sending packets with increasing TTL values (starting at 1). Each router decrements TTL; when it reaches 0, the router discards the packet and sends an ICMP Time Exceeded message back — revealing that router's IP. Traceroute identifies network bottlenecks, routing loops, and points of packet loss.
Question 4
?? Multiple Choice (Easy)
What does the ping command test?
Explanation
Ping sends ICMP Echo Request packets to a target and waits for Echo Reply responses. It reports: round-trip time (RTT), packet loss, and TTL. Useful for verifying basic connectivity. If ping fails, check: host reachability, firewall blocking ICMP, IP routing. Some firewalls block ICMP, causing false failures.
Question 5
?? Multiple Choice (Easy)
Which command displays your computer's IP address, subnet mask, and default gateway in Windows?
Explanation
ipconfig (Windows) displays IP configuration for all adapters. ipconfig /all shows full details including MAC address, DNS servers, DHCP status. ipconfig /release and /renew manage DHCP leases. ipconfig /flushdns clears the DNS cache. Linux/macOS equivalents: ifconfig (deprecated) and ip addr (iproute2).
ipconfig /flushdns clears stale DNS cache — quick fix when only one site fails by name.