A Falcon analyst is reviewing network connections on a host and sees a connection with a state of 'LISTEN'. What does this state indicate about the connection?

The host has an active connection to a remote server

The connection is blocked by the firewall

The host is waiting for an incoming connection on that port

The connection was recently closed

While reviewing a network connection in Falcon, an analyst sees the state 'ESTABLISHED'. What does this state indicate?

The connection is waiting for the initial SYN packet

The connection is blocked by a firewall rule

The connection is active and data can flow between the two endpoints

The connection has been terminated by one of the endpoints

An analyst is reviewing network connections on a host and sees a connection from a process named 'svchost.exe' to an external IP on port 53. The analyst is unsure if this is normal. What should the analyst do to determine if this connection is benign?

Check the host's firewall logs for more details

Check if the process is the legitimate Windows service and if the connection is part of normal DNS resolution

Assume it is malicious because svchost.exe is commonly abused

Immediately block the connection

An analyst is investigating a host that is making connections to multiple external IPs. The analyst wants to identify which process is responsible for the most connections. What is the best way to do this in Falcon?

Use the host's process list to estimate which process is most active

Sort the connections by destination IP

Review the host's network traffic logs

Filter the connections by process and count the results for each process

A security team is monitoring a host that is suspected of data exfiltration. The team wants to set up a view that shows only outbound connections from the host to external IPs on non-standard ports. What is the best way to achieve this in Falcon?

Create a custom dashboard widget for outbound connections

Sort the connections by destination port and manually review

Apply multiple filters: direction (outbound), destination IP (external), and port range

Use the host's firewall rules to identify allowed outbound connections

CrowdStrikeCertified Cloud Specialist (CCCS)

Domain 5Objective 6

5.6 Identify Network Connections CCCS Practice Questions (Page 2)

Part of the Runtime Protection domain, which makes up ~18% of our current practice bank.

27questions here

6free pages

4concepts

Questions 6–10

6application · easy
A Falcon analyst is reviewing network connections on a host and sees a connection with a state of 'LISTEN'. What does this state indicate about the connection?
Select an answer first
7foundation · easy
While reviewing a network connection in Falcon, an analyst sees the state 'ESTABLISHED'. What does this state indicate?
Select an answer first
8expert · hard
An analyst is reviewing network connections on a host and sees a connection from a process named 'svchost.exe' to an external IP on port 53. The analyst is unsure if this is normal. What should the analyst do to determine if this connection is benign?
Select an answer first
9expert · medium
An analyst is investigating a host that is making connections to multiple external IPs. The analyst wants to identify which process is responsible for the most connections. What is the best way to do this in Falcon?
Select an answer first
10expert · hard
A security team is monitoring a host that is suspected of data exfiltration. The team wants to set up a view that shows only outbound connections from the host to external IPs on non-standard ports. What is the best way to achieve this in Falcon?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCCS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCCS” is a trademark of its owner, used for identification only.