CrowdStrike CCCS-203b Exam - Topic 7 Question 17 Discussion

Question

What are three valid states for the state of a port under the Network Events dashboard?

Halina · Accepted Answer

C) Connect, Accept, and Listen

Halina · Answer

A) Open, Connect, and Closed

Halina · Answer

B) Listen, Reject, and Connect

Halina · Answer

D) Accept, Connect, and Reject
In Falcon Cloud Security Network Events, port states reflect how network connections are established and handled at runtime. The platform uses standardized connection state terminology to help analysts understand traffic behavior and intent.
The three valid port states are:
Connect: Indicates an outbound connection attempt initiated by a process or container.
Accept: Represents an inbound connection that was accepted by a listening process.
Listen: Shows that a process is actively listening on a port for incoming connections.
These states provide crucial context for detecting suspicious behavior such as unauthorized listeners, unexpected inbound access, or abnormal outbound communications. Other options include terms not used by Falcon to define port state semantics within Network Events.
Therefore, Connect, Accept, and Listen is the correct answer.