7.3 Conduct Hypothesis and Hunting Lead Generation in Order to Prove Them Using Falcon Tools CCFH Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   Your organization is a healthcare provider. A new regulation requires that patient data be accessed only from approved devices. You have no threat intelligence on any specific adversary. You notice in Falcon that a user is accessing patient records from a device that is not in the approved device list. What is the most appropriate hunting lead source, and what is the primary consideration for formulating a hypothesis?

   • AConfirmed compromise lead; the hypothesis should focus on data exfiltration.
   • BBusiness context lead; the hypothesis should focus on the user's role and whether the access is justified by a business need.
   • CAnomaly lead; the hypothesis should focus on the technical mechanism of the access.
   • DThreat intelligence lead; the hypothesis should focus on identifying the specific malware used.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   You have a hypothesis that a specific user account is compromised and is being used to access sensitive files. You run a Falcon Search and find that the account has accessed several files on a file share. What additional evidence from Falcon would most strongly prove the hypothesis?

   • AThe file access occurred outside of normal business hours.
   • BThe user account has logged in from a new device.
   • CThe file share is not normally accessed by this user.
   • DThe file access events are correlated with a process that was spawned from a known malicious parent process.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   To test a hypothesis about suspicious PowerShell activity, which Falcon tool would a hunter use to search for relevant events?

   • AFalcon Search
   • BFalcon Overwatch
   • CFalcon Spotlight
   • DFalcon Discover
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst suspects that a specific adversary group is using WMI to execute payloads on compromised hosts. You need to formulate a hypothesis that can be directly tested using Falcon Search. Which hypothesis is the most specific, measurable, and actionable?

   • AThe adversary group uses WMI more than other groups.
   • BThe adversary group is active in our environment.
   • CWMI is a common attack vector and should be monitored.
   • DWe will find at least one process created by a WMI event subscription (e.g., CommandLine contains 'wmic process call create') on a domain controller in the last 7 days.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   You are a Falcon hunter. While reviewing Falcon Event Search results, you notice several endpoints with a high volume of failed logon events followed by a successful logon from an unusual geographic location. No threat intelligence has flagged this activity. According to hunting lead sources, what is the most appropriate classification of this lead?

   • AThreat intelligence lead, because the failed logons indicate a known attack pattern.
   • BAnomaly lead, because the pattern deviates from normal user behavior without prior intel.
   • CConfirmed compromise lead, because the successful logon proves an attacker is in the environment.
   • DBusiness context lead, because the user may have traveled to that location.
   Reveal Solution Discussion Select an answer first