5.6 Identify Network Connections CCCS Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   In Falcon's Network Connections view, what does the 'Protocol' metadata field indicate?

   • AThe encryption method used for the connection
   • BThe application-layer protocol, such as HTTP or FTP
   • CThe version of the operating system's networking stack
   • DThe network protocol used for the connection, such as TCP or UDP
   Reveal Solution Discussion Select an answer first
2. 17expert · medium

   A Falcon analyst is investigating a host that is communicating with a known malicious IP. The analyst wants to see all connections from that host to the IP, but also wants to know which processes are involved and whether the connections are still active. What is the most efficient way to gather all this information?

   • AReview the host's running processes and manually check each one's connections
   • BUse the host's event search to find all events related to that IP
   • CFilter the host's connections by the IP, then review the process and state for each result
   • DSort the connections by process name and look for the IP
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A Falcon admin is responding to an alert about a host making connections to a known malicious domain. The admin wants to see all connections from that host to the IP resolved from that domain. What is the first step?

   • AUse the host's browser history
   • BResolve the domain to an IP and then filter the host's connections by that IP
   • CSearch the host's DNS cache for the domain
   • DFilter the host's connections by the domain name
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   A security analyst needs to view the active network connections on a specific Windows host using CrowdStrike Falcon. Which Falcon feature provides this information?

   • AThe Event Search page, by querying for 'NetworkConnection' events
   • BThe Hosts page, by selecting the host and viewing its Network Connections tab
   • CThe IOA Exclusions page, by reviewing exclusions for network-related indicators
   • DThe Detection page, by reviewing detections that involve network activity
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   In Falcon, an analyst wants to search for network connections initiated by a process named 'powershell.exe'. Which filter criteria should they use?

   • AFilter by process name 'powershell.exe'
   • BFilter by port 'powershell.exe'
   • CFilter by destination IP 'powershell.exe'
   • DFilter by protocol 'powershell.exe'
   Reveal Solution Discussion Select an answer first