An incident responder is analyzing a compromised Linux host and wants to identify all network connections established by a suspicious process. Which command provides this information?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you want the combined approach saying both the ss -tnp/netstat -tnp PID-correlation method and the lsof -i -n socket-listing method are valid. They show network connections tied to process IDs, and using both gives you complementary incident-response views. The ps aux | grep suspicious method only shows processes, not their network connections.
Full Explanation
The correct answer is the combined approach saying both the ss -tnp or netstat -tnp PID-correlation method and the lsof -i -n socket-listing method are valid. Those commands show network connections tied to process IDs, and using both gives complementary incident-response views. The process-listing approach using ps aux | grep suspicious is wrong because it lists processes and arguments, not network connections. The ss -tnp or netstat -tnp PID-correlation approach alone is incomplete because lsof provides the same capability through another mechanism. The lsof -i -n socket-listing approach alone is incomplete because using both tools is best practice.