CFA-001 practice question 1 of 25

Which of the following commands shows you the names of all open shared files on a server and number of file locks on each file?

Full set: 180 questions

Domain Network Forensics

Answer options
A: Net sessions
B: Net file Correct answer
C: Netconfig
D: Net share
Correct Answer:
B. Net file
Explanation

The net file command is a standard Windows command-line utility used for network administration and live system analysis. Its specific function is to display a list of all shared files that are currently open on a server by remote users. The output includes the file's unique identification number, its full path, the name of the user who has it open, and, crucially, the number of locks currently placed on the file. This command provides a real-time snapshot of file access activity over the network, which is essential for both administration and forensic investigation.

Why Incorrect

A. Net sessions: This command lists or disconnects user sessions between the server and clients, but it does not provide details on individual files being accessed.
C. Net config: This command is used to display and modify the configuration settings for core network services like 'Server' or 'Workstation', not for viewing active file usage.
D. Net share: This command manages the shared resources themselves (e.g., listing, creating, or deleting shared folders), but it does not show which files within those shares are open.

References

1. Microsoft Corporation. (n.d.). net file. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/net-file

Reference Details: The official documentation states, "Displays the names of all open shared files on a server and the number of file locks on each file. This command can also be used to close shared files and remove file locks." This directly confirms the command's purpose.

2. Carnegie Mellon University, Software Engineering Institute. (2004). Intruder Detection and Isolation. (CMU/SEI-2004-TN-027).

Reference Details: In Section 3.2, "Tools," the document lists net file as a command for incident response on Windows systems to "list open files on the server." This highlights its use in a technical analysis context.

3. Microsoft Corporation. (n.d.). Net services commands. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/net-services-commands

Reference Details: This overview page provides summaries for the other incorrect options. It describes net sessions for managing server computer sessions, net config for displaying service configurations, and net share for managing shared resources, confirming they do not show open files or locks.

Scroll to Top