5.6 Identify Network Connections CCCS Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An analyst sees a UDP connection in Falcon's network connections view. What is a key difference between this UDP connection and a typical TCP connection that the analyst should consider?

   • AUDP connections always use port 53
   • BUDP connections do not have a connection state like ESTABLISHED
   • CUDP connections are encrypted by default
   • DUDP connections are always initiated by system processes
   Reveal Solution Discussion Select an answer first
2. 2application · easy

   A Falcon administrator needs to quickly find all outbound connections from a specific host to a known malicious IP address. The administrator is in the Falcon console's network connections view for that host. What is the most efficient way to narrow the list?

   • ASort the list by source port
   • BNavigate to the process details and look for the IP there
   • CExport the list to CSV and open it in a spreadsheet
   • DUse the search/filter bar to filter by destination IP
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   In Falcon's Network Connections view for a host, which details are typically displayed for each active connection?

   • AOnly the protocol and connection state
   • BOnly the destination IP and port
   • CSource IP, destination IP, source port, and destination port
   • DOnly the process name and its parent process
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   An incident responder is investigating a host that is running a legitimate business application. The application makes outbound connections to multiple external IPs on various ports. The responder needs to determine if any of these connections are malicious. Which approach in Falcon would provide the most comprehensive understanding?

   • AReview all connections from the host and correlate each with the process that initiated it, then compare against known-good behavior
   • BBlock all outbound connections from the host and monitor for alerts
   • CFocus only on connections to external IPs on non-standard ports
   • DCheck the host's firewall rules to see which connections are allowed
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security team wants to identify any process on a host that is communicating with a specific IP address. The team has access to Falcon's network connections view. What is the best approach?

   • AFilter the connections by that IP address and then review the associated processes
   • BRun a network scan from the host
   • CUse the host's event log to find the IP
   • DSort the connections by process name
   Reveal Solution Discussion Select an answer first