7.3 Conduct Hypothesis and Hunting Lead Generation in Order to Prove Them Using Falcon Tools CCFH Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which statement best defines a hypothesis in the context of threat hunting?

   • AA confirmed finding that an adversary has compromised the environment
   • BA testable statement about adversary behavior or environment compromise
   • CA summary of the final results and conclusions of a completed hunt
   • DA list of all known indicators of compromise (IOCs) related to a threat actor
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is a valid source of hunting leads?

   • AThe personal opinions of the security team
   • BThe company's annual budget report
   • CThe organization's marketing strategy
   • DThreat intelligence reports
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   After running an initial Falcon Search query, a hunter finds too many results, many of which are unrelated to the hypothesis. What is the most appropriate next step?

   • AIgnore the unrelated results and focus only on the first few
   • BRefine the hypothesis and query to be more specific
   • CAbandon the hunt and move to a different hypothesis
   • DExpand the time range to include more data
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security operations center (SOC) analyst shares a report about a new ransomware strain that uses scheduled tasks for persistence. Your organization has not seen this strain, but you have a hypothesis that it may be present. Which hunting lead source is most directly applicable to this scenario?

   • AConfirmed compromise, because the ransomware is known to be active.
   • BAnomaly, because the ransomware behavior is unusual.
   • CBusiness context, because the organization may be a target.
   • DThreat intelligence, because the lead comes from an external report about a specific threat.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A financial services company recently experienced a phishing campaign that delivered a known banking trojan. The threat intelligence team shared a report indicating the trojan now uses a new, previously unseen persistence mechanism: it creates a scheduled task named 'SysUpdate' that runs a PowerShell script from a temp directory. You are starting a hunt. Which statement best represents a well-formed hypothesis for this hunt?

   • AThe banking trojan is present in our environment.
   • BThe threat intelligence report is accurate and the trojan's behavior is as described.
   • CIf the trojan is present, we will find a scheduled task named 'SysUpdate' executing PowerShell from a temp directory on at least one endpoint.
   • DPowerShell is a commonly abused tool and should be monitored more closely.
   Reveal Solution Discussion Select an answer first