3.1 Analyze and Interpret Metadata Around Files and Processes Recorded by Falcon CCFH Practice Questions (Page 4)

Questions 16–19

1. 16foundation · easy

   In a threat-hunting search, you want to find processes that were launched from a temporary directory, which is a common sign of malware. Which metadata field should you filter on?

   • AFile path
   • BProcess ID
   • CProcess command line
   • DUser context
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An analyst is investigating a file that was executed on a host. The file's metadata shows a creation timestamp of 2023-05-10 14:32:00 UTC and a last-write timestamp of 2023-05-10 14:32:05 UTC. The file is named 'update_installer.exe' and is located in C:\Users\Public\Downloads. The analyst also sees a process event for the same file with a start timestamp of 2023-05-10 14:32:10 UTC. What does the 5-second gap between the last-write and process start suggest?

   • AThe file was executed from a network share
   • BThe file was modified after execution
   • CThe file is a false positive because the timestamps are too close
   • DThe file was downloaded and executed quickly, indicating automated or scripted behavior
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   A Falcon event shows a file with a SHA256 hash. What does this metadata field uniquely identify?

   • AThe file's creation time, indicating when it was first written
   • BThe file's owner, showing which user account created it
   • CThe file's content, allowing comparison against known threat intelligence
   • DThe file's location on disk, such as the full directory path
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An analyst is reviewing a file alert for 'C:\Windows\Temp\tmp1234.tmp'. The file's size is 0 bytes, and its creation timestamp is 30 seconds before a known malicious process started. Which interpretation of the file metadata is MOST accurate?

   • AThe file was likely created as a temporary file by the malicious process for staging or as a marker
   • BThe file was created by the operating system for a legitimate update
   • CThe file is a false positive because it is in the Temp folder
   • DThe file is a zero-byte file and therefore harmless
   Reveal Solution Discussion Select an answer first