7.3 Conduct Hypothesis and Hunting Lead Generation in Order to Prove Them Using Falcon Tools CCFH Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   An analyst notices an unusual spike in failed logon attempts from a single IP address. Which type of hunting lead does this represent?

   • AVulnerability scan
   • BBusiness context
   • CAnomaly
   • DThreat intelligence
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   You are hunting for a possible insider threat who is exfiltrating data via USB drives. Your initial hypothesis is: 'An employee is copying sensitive files to a USB drive.' Your first query for 'USB drive' returns no results. You then refine to search for 'Removable Media' and find a few hits. However, you are concerned about false positives from legitimate USB use. Which refinement is the most effective to prove the hypothesis?

   • ASearch for the specific file names of sensitive documents being copied to the USB drive.
   • BSearch for all users who have used a USB drive in the last 30 days.
   • CConclude the hypothesis is false because the initial query returned no results.
   • DCorrelate the USB drive insertion with the user's activity and look for a large number of file copy events in a short period.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   You are hunting for a suspected credential theft via LSASS access. Your initial query for 'lsass.exe' process access returns hundreds of hits, mostly from legitimate security software. How should you refine the hypothesis to reduce false positives?

   • AExpand the search to include all process access events, not just LSASS.
   • BNarrow the search to processes that accessed LSASS and then made a network connection to an external IP.
   • CSearch for the specific process name 'mimikatz.exe'.
   • DConclude the hypothesis is false because of the high number of benign hits.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which hypothesis is most specific and testable using Falcon tools?

   • AA user may have run a malicious PowerShell command
   • BThe environment might be compromised
   • CSomething bad is happening on the network
   • DThe company should improve its security posture
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary purpose of a hypothesis in a threat hunting engagement?

   • ATo guide the hunt by providing a focused, testable statement to investigate
   • BTo replace the need for collecting evidence during the hunt
   • CTo document the final findings for management review
   • DTo provide a definitive answer about whether the environment is compromised
   Reveal Solution Discussion Select an answer first