A security analyst needs to identify all hosts in the environment that have active connections to a specific internal IP address. How can the analyst accomplish this using Falcon?

Use the host management page to filter by IP

Check each host's network connections individually

Use the Falcon search to find connections by destination IP across all hosts

Review the firewall logs for that IP

A Falcon analyst is investigating a suspicious process that is making outbound connections. The analyst wants to see all connections initiated by that specific process. What is the most efficient way in Falcon?

Sort the connections by destination port

Filter the network connections view by the process name or ID

Review the process's file details

An analyst is investigating a host that may be exfiltrating data. The analyst wants to see all active network connections on the host. In Falcon, where should the analyst look?

The host's network connections tab in the Falcon console

The host's event search results

An analyst is reviewing network connections on a host and sees a connection with a state of 'TIME_WAIT'. What does this indicate?

The connection is closing and waiting for any remaining packets

The connection is blocked by the firewall

The connection is listening for new connections

The connection is actively transferring data

An analyst sees a network connection to an external IP address in Falcon. To determine which application on the host initiated this connection, what should the analyst examine?

The 'Source Port' field of the connection

The 'State' field of the connection

The 'Destination IP' field of the connection

The 'Process' field associated with the connection

CrowdStrikeCertified Cloud Specialist (CCCS)

Domain 5Objective 6

5.6 Identify Network Connections CCCS Practice Questions (Page 5)

Part of the Runtime Protection domain, which makes up ~18% of our current practice bank.

27questions here

6free pages

4concepts

Questions 21–25

21application · medium
A security analyst needs to identify all hosts in the environment that have active connections to a specific internal IP address. How can the analyst accomplish this using Falcon?
Select an answer first
22application · medium
A Falcon analyst is investigating a suspicious process that is making outbound connections. The analyst wants to see all connections initiated by that specific process. What is the most efficient way in Falcon?
Select an answer first
23application · easy
An analyst is investigating a host that may be exfiltrating data. The analyst wants to see all active network connections on the host. In Falcon, where should the analyst look?
Select an answer first
24application · easy
An analyst is reviewing network connections on a host and sees a connection with a state of 'TIME_WAIT'. What does this indicate?
Select an answer first
25foundation · easy
An analyst sees a network connection to an external IP address in Falcon. To determine which application on the host initiated this connection, what should the analyst examine?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCCS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCCS” is a trademark of its owner, used for identification only.