6.7 Differentiate Testing, DevOps or General User Activity from Adversary Behavior CCFH Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which action is an indicator of privilege escalation?

   • AA user changing their own password
   • BAn administrator running a routine software update
   • CA standard user account adding itself to the local Administrators group
   • DA developer pushing code to a repository
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A Falcon Hunter is investigating a series of file modifications on a file server. The modifications occur at 2:00 AM, use a service account, and target files in a shared directory. The hunter checks the baseline and finds that the same service account modifies files in the same directory at the same time every night. What is the MOST likely explanation?

   • AAn adversary is encrypting files for a ransomware attack, as the modifications occur during off-hours.
   • BA malware infection is spreading through the file server, modifying files to propagate.
   • CA user is working late and modifying files, but the service account is a misconfiguration.
   • DA scheduled backup or synchronization job that runs nightly and modifies files as part of its operation.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which tool is specifically designed to query endpoint telemetry for hunting?

   • ASysinternals Process Explorer
   • BFalcon Event Search
   • CEvent Viewer
   • DWireshark
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which activity is a clear indicator of adversary behavior?

   • ALateral movement to multiple servers using administrative shares
   • BScheduled backup jobs running at night
   • CDeployment of a new application version
   • DUser logging in from a known VPN endpoint
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A Falcon Hunter is investigating a series of failed logon events for a domain administrator account. The failures occur from a single source IP at 3:00 AM local time, with 10 attempts per minute for 30 minutes. The hunter checks the environment baseline and finds that the same account has a history of failed logons from the same IP at the same time every Sunday. What is the MOST likely explanation for this activity?

   • AA user who forgot their password and is trying to log in during off-hours.
   • BA scheduled maintenance task or script that uses the administrator account and runs weekly during the observed window.
   • CAn adversary performing a brute-force attack, as the frequency and timing are classic indicators of credential stuffing.
   • DA misconfigured service account that is attempting to authenticate with the wrong password.
   Reveal Solution Discussion Select an answer first