During an incident response, a technician needs to quickly check all established connections from a server to external addresses.
Which command would provide this information most effectively?
Correct Answer: C
Correct Answer. C. ss state established Using ss state established filters the output to only show currently established connections, allowing the technician to quickly review active connections without the clutter of listening or other socket states.
Option A is incorrect. While ss -at shows all TCP sockets, it does not specifically filter for established connections.
Option B is incorrect. ss -r resolves domain names for connected addresses, which is not specifically useful for quickly identifying active connections.
Option D is incorrect. ss -l lists only listening sockets, which are not relevant for identifying active outgoing connections.