2.1 Analyze Information Displayed in the Host Timeline to Understand Host States and Events CCFH Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security analyst is reviewing the Host Timeline for a compromised endpoint. The analyst sees an event with a shield icon and wants to understand what action was taken. After clicking on the event, which detail would provide the most context about the action performed?

   • AThe event's description and associated policy name
   • BThe host's IP address
   • CThe event's timestamp
   • DThe event's severity level
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   A Falcon Hunter opens the Host Timeline for a specific host. What is the primary purpose of the navigation controls at the top of the Host Timeline interface?

   • ATo modify the host's detection severity level
   • BTo export the entire host's event history to a CSV file
   • CTo change the host's assigned sensor policy
   • DTo move backward and forward through the timeline and jump to specific time ranges
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   An analyst is investigating a malware infection. The Host Timeline shows the following sequence of events: a 'FileWrite' event at 10:00:00, a 'ProcessCreate' event at 10:00:05, and a 'NetworkConnect' event at 10:00:10. The analyst needs to determine the most likely sequence of activities. Which interpretation is most accurate?

   • AA process was created, then it wrote a file, and then it made a network connection
   • BA network connection was made, then a file was written, and then a process was created
   • CA file was written, then a process was created from it, and then the process made a network connection
   • DA process was created, then it made a network connection, and then it wrote a file
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   A Falcon Hunter wants to view only network connection events in the Host Timeline. What is the most efficient way to do this?

   • AApply a filter for the event type 'Network Connections'
   • BExport all events to a CSV file
   • CScroll through the entire timeline manually
   • DChange the host's time zone
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   In the Host Timeline, how can an analyst access detailed information about a specific event?

   • ARight-click the event and select 'Delete'
   • BClick on the event to open its details panel
   • CHover over the event icon to see a summary
   • DDouble-click the host name in the Hosts page
   Reveal Solution Discussion Select an answer first