7.3 Conduct Hypothesis and Hunting Lead Generation in Order to Prove Them Using Falcon Tools CCFH Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What makes a hypothesis 'actionable' in the context of threat hunting?

   • AIt is approved by management before the hunt begins
   • BIt can be translated into specific searches or queries in Falcon tools
   • CIt is based on the latest threat intelligence
   • DIt describes a broad range of possible adversary behaviors
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   Your company is about to launch a new product, and the marketing team is using a new SaaS application for campaign management. You have no threat intelligence on this application. A user in marketing reports that their machine is running slowly. You notice in Falcon that the SaaS application's process is making many outbound connections. What is the most appropriate source of this hunting lead?

   • AConfirmed compromise, because the outbound connections indicate data exfiltration.
   • BBusiness context, because the new SaaS application is a known business change that could explain the behavior.
   • CAnomaly, because the process is making many outbound connections.
   • DThreat intelligence, because the outbound connections are suspicious.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   During a hunt, initial results show no matches for the exact command line pattern hypothesized. What should the hunter do next?

   • AConclude the hypothesis is false and stop the hunt
   • BBroaden the query to look for similar variations of the pattern
   • CReport the results as conclusive evidence against the hypothesis
   • DDelete the hunt and start over with a new hypothesis
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   You are hunting for a suspected data exfiltration via DNS tunneling. Your hypothesis is: 'An endpoint is encoding data in DNS queries to a malicious domain.' You run a Falcon Search for DNS requests and find a host making thousands of requests to a domain that is not on any blocklist. Which Falcon tool output would provide the strongest evidence to prove this hypothesis?

   • AA threat intelligence report on the domain.
   • BA list of all DNS requests from the host, showing the volume and the domain.
   • CA process tree showing the process that initiated the DNS requests, along with its command line.
   • DA network connection event showing the DNS query payload with subdomains that contain base64-encoded data.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   A hunter runs a Falcon Search query and finds several events that match the hypothesis. What does this indicate about the hypothesis?

   • AThe hypothesis is proven true
   • BThe hypothesis is supported by evidence
   • CThe hunt is complete and no further analysis is needed
   • DThe hypothesis is definitely false
   Reveal Solution Discussion Select an answer first