A Falcon admin needs to produce a report of all active network connections on a specific host for a compliance audit. The report must include source and destination IPs, ports, and the associated process. What is the best way to generate this report using Falcon?

Use the network connections view and export the data

Take screenshots of the connection list

Manually copy the data into a spreadsheet

Use the host's netstat command and save the output

During an incident response, an analyst sees an established TCP connection to an external IP on port 4444. The analyst needs to determine which application is responsible for this connection. What should the analyst do in Falcon?

Check the host's firewall rules

Look at the network interface statistics

View the connection details and look at the associated process

A Falcon analyst needs to find all connections on a host that use a specific port, such as 3389, to identify potential RDP activity. What is the best way to do this in Falcon?

Review the host's running services

Search the host's event logs for port 3389

Filter the network connections view by that port

Sort the connections by source IP

An analyst wants to find all network connections on a host that use port 443. In Falcon's Network Connections view, what is the most efficient way to do this?

Manually scroll through the list of connections

Export the list to a CSV and use a spreadsheet to filter

Use the Detection page to search for port 443

Use the filter option to filter by port 443

A security analyst is investigating a host that is suspected of beaconing to a command-and-control server. The analyst opens the Falcon console and navigates to the host's network connections. Which two pieces of information from the connection list would be most useful to confirm the beaconing behavior?

The source IP and MAC address of the host

The protocol and the total number of packets sent

The connection state and the host's operating system version

The destination IP and port, along with the process that established the connection

CrowdStrikeCertified Cloud Specialist (CCCS)

Domain 5Objective 6

5.6 Identify Network Connections CCCS Practice Questions (Page 3)

Part of the Runtime Protection domain, which makes up ~18% of our current practice bank.

27questions here

6free pages

4concepts

Questions 11–15

11expert · medium
A Falcon admin needs to produce a report of all active network connections on a specific host for a compliance audit. The report must include source and destination IPs, ports, and the associated process. What is the best way to generate this report using Falcon?
Select an answer first
12application · easy
During an incident response, an analyst sees an established TCP connection to an external IP on port 4444. The analyst needs to determine which application is responsible for this connection. What should the analyst do in Falcon?
Select an answer first
13application · easy
A Falcon analyst needs to find all connections on a host that use a specific port, such as 3389, to identify potential RDP activity. What is the best way to do this in Falcon?
Select an answer first
14foundation · easy
An analyst wants to find all network connections on a host that use port 443. In Falcon's Network Connections view, what is the most efficient way to do this?
Select an answer first
15application · medium
A security analyst is investigating a host that is suspected of beaconing to a command-and-control server. The analyst opens the Falcon console and navigates to the host's network connections. Which two pieces of information from the connection list would be most useful to confirm the beaconing behavior?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCCS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCCS” is a trademark of its owner, used for identification only.