CCCS-203B: CrowdStrike Certified Cloud Specialist

By CrowdStrike · Question Mode

QuestionQ60

VerifiedFindings and Detection Analysis

You receive an alert about suspicious network traffic from a container environment over destination port 1337.

What is the most efficient way to identify the container and pod from which the connections originate by using Cloud Security?

Explanation

For an outbound connection, the destination port is recorded as the remote port. Filtering Cloud Security Network Events for remote port 1337 directly returns the relevant connection records and their container and pod context, making it the most efficient investigation path.

Community Discussion

No comments yet. Be the first to start the discussion!