Why is it important to correlate network connections with the processes that initiated them?

To identify the operating system of the remote host

To determine the physical location of the remote server

To calculate the bandwidth usage of the connection

To understand which application is responsible for the network activity

An analyst is reviewing a network connection in Falcon and sees that the associated process is 'powershell.exe'. The connection is to an external IP on port 443. What should the analyst consider when determining if this is malicious?

The connection is definitely malicious because PowerShell is often used by attackers

The connection is definitely benign because port 443 is standard for HTTPS

Whether the PowerShell process is expected to make outbound HTTPS connections in this environment

The connection is a false positive and can be ignored

CrowdStrikeCertified Cloud Specialist (CCCS)

Domain 5Objective 6

5.6 Identify Network Connections CCCS Practice Questions (Page 6)

Part of the Runtime Protection domain, which makes up ~18% of our current practice bank.

27questions here

6free pages

4concepts

Questions 26–27

26foundation · easy
Why is it important to correlate network connections with the processes that initiated them?
Select an answer first
27expert · hard
An analyst is reviewing a network connection in Falcon and sees that the associated process is 'powershell.exe'. The connection is to an external IP on port 443. What should the analyst consider when determining if this is malicious?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CCCS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCCS” is a trademark of its owner, used for identification only.

5.6 Identify Network Connections CCCS Practice Questions (Page 6)

Questions 26–27

Why is it important to correlate network connections with the processes that initiated them?

An analyst is reviewing a network connection in Falcon and sees that the associated process is 'powershell.exe'. The connection is to an external IP on port 443. What should the analyst consider when determining if this is malicious?

Keep studying — Runtime Protection