6.7 Differentiate Testing, DevOps or General User Activity from Adversary Behavior CCFH Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A Falcon Hunter is reviewing telemetry from a file server and sees a user account 'jdoe' accessing a large number of files in a short period. The user is a data analyst who regularly accesses the file server for reports. The hunter checks the baseline and finds that 'jdoe' typically accesses a small number of files per day. What is the MOST likely explanation for the sudden increase in file access?

   • AThe user 'jdoe' is likely testing a new application that accesses files.
   • BThe user 'jdoe' is likely working on a project that requires access to many files.
   • CThe user 'jdoe' is likely running a legitimate report that requires access to many files.
   • DThe user 'jdoe' may be involved in data exfiltration, as the access pattern deviates significantly from the baseline.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which contextual factor is most useful for differentiating a test account from a compromised account?

   • AThe account's password complexity
   • BThe source IP address and the account's naming convention
   • CThe number of failed login attempts
   • DThe type of operating system used
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A Falcon Hunter is reviewing an alert that shows a container orchestration platform creating a new container with a privileged security context. The container is running a command that mounts the host filesystem and executes a script. The platform is used by a DevOps team for application deployment. The alert fires during a scheduled deployment. Which finding would MOST strongly indicate adversary behavior?

   • AThe container is created during a scheduled deployment window.
   • BThe script executed in the container attempts to modify the host's SSH configuration to allow root login.
   • CThe container is running with a privileged security context.
   • DThe container mounts the host filesystem.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A Falcon Hunter is investigating a series of PowerShell commands that create a scheduled task on a domain controller. The commands run from a user account that is part of the IT administration team. The hunter checks the baseline and finds that the IT team uses a configuration management tool that runs PowerShell scripts to enforce compliance. The scheduled task is named 'ComplianceCheck' and runs daily at 6:00 AM. Which finding would MOST strongly indicate adversary behavior?

   • AThe PowerShell commands are run from an account in the IT administration team.
   • BThe scheduled task is named 'ComplianceCheck' and runs daily at 6:00 AM.
   • CThe scheduled task is created on a domain controller.
   • DThe scheduled task runs a script that downloads and executes a payload from a newly registered domain.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which pattern is most characteristic of automated testing scripts?

   • AUse of a newly created admin account
   • BLogins occurring at random, unpredictable times
   • CAccess to sensitive files outside business hours
   • DHigh-frequency, repetitive actions from a single account
   Reveal Solution Discussion Select an answer first