7.1 Identify Recommended Remediation Steps for Findings and Detections CCCS Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   A CrowdStrike Falcon detection shows that a host is beaconing to a command-and-control (C2) server. Which remediation action is most appropriate to stop the communication?

   • AQuarantine the file
   • BRun a vulnerability scan
   • CDisable the user account
   • DBlock the indicator
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security team has two detections: a high-severity ransomware on a file server and a medium-severity credential theft on a domain controller. The file server is already isolated. The domain controller is not isolated. The team has limited resources. Which detection should be remediated next?

   • AThe one that was detected first.
   • BThe ransomware on the file server, because it has higher severity.
   • CThe credential theft on the domain controller, because it is still active and has high impact.
   • DBoth equally, because they are both critical.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   A CrowdStrike Falcon detection indicates that a suspicious file was written to disk but no process is currently executing it. Which remediation step is most appropriate for this finding?

   • AIsolate the host
   • BBlock the file's hash
   • CReboot the host
   • DQuarantine the file
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   An analyst has two detections to remediate: one is a critical severity detection on a domain controller, and the other is a medium severity detection on a non-critical file server. According to best practices, which detection should be remediated FIRST?

   • AThe critical severity detection on the domain controller
   • BThe medium severity detection on the file server
   • CThe one that was detected first
   • DBoth at the same time
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A finding shows that a host has an outdated antivirus signature. The host is a low-priority asset. What is the recommended remediation step?

   • AIsolate the host until signatures are updated.
   • BReplace the host with a new one.
   • CMonitor the host for infections.
   • DUpdate the antivirus signatures on the host.
   Reveal Solution Discussion Select an answer first