Question 1easymultiple choice
Read the full Technology Essentials explanation →A SOC analyst observes excessive traffic on port 443 originating from an internal server to an unknown external IP. Which command should the analyst run on a Linux-based server to identify the specific process ID (PID) associated with this connection?
Trap 1: ps -ef | grep 443
ps displays process status but does not correlate process IDs with network sockets.
Trap 2: route -n
route manages the routing table and does not show active socket connections to processes.
Trap 3: tcpdump -i eth0 port 443
tcpdump captures traffic but does not map the traffic to a local PID.
- A
ps -ef | grep 443
Why wrong: ps displays process status but does not correlate process IDs with network sockets.
- B
lsof -i :443
lsof lists open files and is the most direct way to associate a network port with a PID.
- C
route -n
Why wrong: route manages the routing table and does not show active socket connections to processes.
- D
tcpdump -i eth0 port 443
Why wrong: tcpdump captures traffic but does not map the traffic to a local PID.