6.3 Evaluate Information for Reliability, Validity and Relevance for Use in the Process of Elimination CCFH Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   During a hunt for a specific malware family, an analyst encounters a log entry showing a benign software update. How should this information be classified in terms of relevance?

   • ARelevant, because it is from a reliable source.
   • BRelevant, because it is a log entry that could be analyzed further.
   • CIrrelevant, because it does not directly apply to the hunting hypothesis.
   • DIrrelevant, because it is not from a threat intelligence feed.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A Falcon Hunter is investigating a potential credential-theft campaign. A junior analyst provides a Falcon Intelligence Premium report from a third-party researcher claiming that a specific malware family is the primary tool used in the campaign. The hunter notices the report cites only one source—a single blog post—and the indicators listed do not match any telemetry in the environment. According to the process of elimination, what should the hunter do with this report?

   • AEliminate the report from consideration because it lacks corroboration and its indicators do not align with observed telemetry.
   • BForward the report to the threat intelligence team for further investigation without any preliminary assessment.
   • CKeep the report as a lead and expand the search to include all indicators from the blog post, even if they are not present in the environment.
   • DAccept the report as reliable because it comes from a named third-party researcher with Falcon Intelligence Premium access.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A Falcon Hunter is investigating a potential supply-chain attack. The hunter has four pieces of information: (1) a Falcon event showing a signed binary from a trusted vendor executing on a server, (2) a public CVE advisory for that vendor's product, (3) a blog post from an unknown researcher claiming the vendor is compromised, and (4) a Falcon event showing the same binary communicating with an external IP not in the vendor's known infrastructure. The hunter must decide which information to use for further hunting. Which piece of information should the hunter prioritize?

   • AThe blog post from the unknown researcher, because it claims the vendor is compromised and provides a narrative.
   • BThe Falcon event showing the binary communicating with an unknown external IP, because it is directly relevant and valid.
   • CThe public CVE advisory, because it provides context for the vulnerability and is from a credible source.
   • DThe signed binary execution event, because it is from a trusted vendor and is therefore reliable.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A Falcon Hunter is triaging a large set of alerts from a single host. The host is a domain controller with a known, approved administrative script that runs daily. The alerts include: (1) a script execution matching the approved script's hash, (2) a PowerShell command invoking a network share, and (3) a scheduled task creation. The hunter has limited time and must decide which alerts to investigate first. The approved script is documented in the change management system, and the network share is a known admin share. The scheduled task creation is not documented. Which alert should the hunter prioritize for investigation?

   • AThe script execution, because it matches the approved script's hash and is therefore the most reliable alert.
   • BThe PowerShell command, because network share access is a common lateral-movement technique.
   • CAll three alerts equally, because each represents a potential threat and should be investigated in parallel.
   • DThe scheduled task creation, because it is undocumented and represents a potential persistence mechanism.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A Falcon Hunter is triaging a set of alerts from a compromised host. The alerts include: (1) a PowerShell script downloading a file from a known malicious domain, (2) a scheduled task creation, and (3) a legitimate software update. The hunter has limited time and must decide which alerts to investigate first. The PowerShell script is documented in a threat intel report, the scheduled task is not documented, and the software update is from a trusted vendor. Which alert should the hunter deprioritize?

   • AThe scheduled task creation, because it is undocumented and could be a persistence mechanism.
   • BThe PowerShell script, because it is documented in a threat intel report and is therefore a known threat.
   • CThe legitimate software update, because it is from a trusted vendor and is expected behavior.
   • DAll three alerts equally, because each represents a potential threat and should be investigated in parallel.
   Reveal Solution Discussion Select an answer first