Netcat (nc) is a tiny utility that reads and writes data across network connections. Both attackers and defenders use it. A CySA+ analyst must recognise its presence on a host because Netcat is a classic indicator of compromise — frequently used for reverse shells, bind shells, port relays, and ad-hoc data exfiltration.
Common defensive uses: banner grabbing, quick port listeners for firewall testing, simple file transfers across DMZs.
Variants you may see on the exam: nc, ncat (Nmap), socat, BSD vs GNU implementations (-e execve flag is often stripped on hardened distros — for good reason).