6.7 Differentiate Testing, DevOps or General User Activity from Adversary Behavior CCFH Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A Falcon Hunter is using a hunting query to identify processes that are listening on network ports. The query returns a process named 'node.exe' listening on port 8080 on a development server. The server is used by a team that runs Node.js applications for testing. The hunter also sees the same process listening on port 8080 on a production server. What is the MOST effective way to differentiate testing activity from adversary behavior?

   • ACheck if the production server has the same application code as the development server.
   • BCompare the parent process of 'node.exe' on both servers to see if it was started by a legitimate process manager or a suspicious script.
   • CConfirm that the development team has access to the production server.
   • DVerify that the production server is patched and up to date.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which artifact is a common indicator of software testing activity?

   • ACredential dumping via LSASS
   • BSynthetic transactions
   • CNetwork scanning of the entire subnet
   • DPersistence via scheduled tasks
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A Falcon Hunter notices a series of authentication events from a single workstation to multiple servers in the environment. The events occur every 15 minutes, use a service account named 'svc_apptest', and originate from a known QA engineer's machine during business hours. The target servers are all in the application tier. Which combination of observations MOST strongly indicates this is testing activity rather than adversary behavior?

   • AThe source is a workstation rather than a server, which is unusual for service account usage and therefore indicates compromise.
   • BThe events occur at a regular 15-minute interval, which is a hallmark of an automated adversary beaconing to multiple servers.
   • CThe account name matches a documented test service account, the source is a known QA workstation, and the targets are application servers.
   • DThe events target multiple servers, which is a clear indicator of lateral movement and should be treated as an active adversary.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A Falcon Hunter is investigating a series of logon events for a user account 'jsmith'. The logons occur from a workstation in the marketing department, but 'jsmith' is a developer in the engineering department. The logons occur at 2:00 AM and are followed by access to a file share containing source code. The hunter checks the baseline and finds that 'jsmith' has never logged on from the marketing department before. What is the MOST likely explanation?

   • AThe activity is likely a scheduled task that runs under 'jsmith's' account.
   • BThe user 'jsmith' is working late and using a different workstation.
   • CThe account 'jsmith' may be compromised, as the source workstation and time are inconsistent with the user's normal behavior.
   • DThe activity is likely a misconfigured application using 'jsmith's' account.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary benefit of using hunting queries to differentiate testing activity from adversary behavior?

   • AThey provide real-time alerts for all anomalies
   • BThey allow you to search for specific patterns across large datasets
   • CThey replace the need for human analysis
   • DThey can automatically block malicious activity
   Reveal Solution Discussion Select an answer first