6.3 Evaluate Information for Reliability, Validity and Relevance for Use in the Process of Elimination CCFH Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A Falcon Hunter is reviewing a threat intel report about a new banking trojan. The report is from a reputable vendor and includes a detailed analysis of the trojan's behavior. However, the hunter notices that the report's IOCs include IP addresses that are also listed in a six-month-old report about a different trojan. What should the hunter do with the current report?

   • AEliminate the report entirely because the overlapping IOCs prove it is a copy-paste error.
   • BTreat the report with caution and seek corroboration because the overlapping IOCs suggest potential inaccuracy.
   • CUse the report as-is because the vendor is reputable and the analysis is detailed.
   • DUse only the IOCs that are unique to the current report and ignore the overlapping ones.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   A Falcon hunter is evaluating a threat intelligence report from a well-known security vendor. The report's findings are also mentioned in two other independent industry publications. How does this scenario affect the reliability of the information?

   • AIt makes the information valid but not reliable.
   • BIt increases reliability because the information is corroborated by independent sources.
   • CIt decreases reliability because multiple sources may have copied each other.
   • DIt has no effect on reliability because only the original source matters.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A Falcon Hunter is investigating a hypothesis that a specific APT group is using a custom backdoor in the environment. The hunter has three pieces of evidence: (1) a Falcon event showing a process named 'svchost.exe' running from a temp directory, (2) a threat intel report from a reputable vendor describing the APT's TTPs, and (3) a Falcon event showing a network connection to an IP address listed in the intel report. The hunter must decide which evidence is most relevant to the hypothesis. Which piece of evidence should the hunter prioritize?

   • AThe threat intel report, because it describes the APT's TTPs and is from a reputable vendor.
   • BAll three pieces of evidence equally, because each contributes to the overall picture.
   • CThe network connection to the IP address from the intel report, because it directly links the environment to the APT's infrastructure.
   • DThe process named 'svchost.exe' running from a temp directory, because it is a classic sign of malware.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A hunter is reviewing a Falcon Intelligence report about a new ransomware strain. The report is published by a well-known security vendor and includes IOCs that match several hosts in the environment. However, the hunter notices that the report's IOCs are identical to a report published six months ago for a different ransomware family. What should the hunter conclude about the current report?

   • AThe report is unreliable because the IOCs are not unique to the new strain, indicating a potential copy-paste error or recycled intelligence.
   • BThe report is reliable because it comes from a well-known vendor, and the IOCs match the environment.
   • CThe report is valid because the IOCs are present in the environment, confirming the ransomware strain is active.
   • DThe report is relevant because the IOCs match the environment, so it should be used for hunting regardless of the duplication.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   In the context of Falcon hunting, what does it mean for a piece of information to be relevant to a hunting hypothesis?

   • AIt is from a reliable source and has been corroborated by others.
   • BIt is recent and has a high severity score.
   • CIt directly applies to the hypothesis and has significance for the investigation.
   • DIt is accurate and complete according to known facts.
   Reveal Solution Discussion Select an answer first