6.3 Evaluate Information for Reliability, Validity and Relevance for Use in the Process of Elimination CCFH Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   During a hunt for lateral movement, a hunter reviews a Falcon Event Search result showing a PowerShell process spawning from an Office application on a workstation. The event timestamp is 14:32 UTC, but the workstation's timezone is UTC-5, and the user was on approved leave that day. The hunter also finds a separate event showing the same workstation was powered off at 14:28 UTC. How should the hunter treat the PowerShell event?

   • AEliminate the event as invalid because the workstation was powered off before the event timestamp, making the data inaccurate.
   • BAdjust the timestamp to UTC-5 and continue the hunt, assuming the timezone offset explains the discrepancy.
   • CKeep the event as a lead but note the timezone difference for later correlation with other sources.
   • DTreat the event as a high-priority lead because PowerShell from Office is a classic lateral-movement technique.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   When assessing the reliability of an intelligence source during a Falcon hunting investigation, which combination of factors is most appropriate to consider?

   • AThe source's IP address, the file hash of the report, and the timestamp of the event
   • BThe age of the source, the language used, and the format of the report
   • CSource credibility, consistency of reporting, and corroboration by independent sources
   • DThe number of alerts generated, the severity of the alert, and the MITRE ATT&CK technique ID
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A hunter is investigating a hypothesis that a specific DLL sideloading vulnerability is being exploited in the environment. During the hunt, the hunter finds a Falcon event showing a legitimate Windows process loading a DLL from a user-writable directory. The DLL hash is not in any threat intel feed, but the directory path matches a known pattern from a public CVE advisory. What should the hunter do with this event?

   • ARetain the event as relevant because the DLL load path matches the CVE pattern, directly supporting the hypothesis.
   • BEliminate the event because legitimate Windows processes loading DLLs is normal behavior and not suspicious.
   • CEliminate the event because the DLL hash is not in any threat intel feed, indicating it is not malicious.
   • DRetain the event only if the DLL is signed by a trusted publisher, otherwise eliminate it.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   A Falcon hunter finds a log entry that appears to show a malicious command, but the timestamp is inconsistent with other evidence in the investigation. How should the analyst treat this information in terms of validity?

   • AConsider the information valid because it is from a system log.
   • BConsider the information relevant because it shows a malicious command.
   • CConsider the information reliable because it came from a trusted log source.
   • DConsider the information invalid because it does not align with known facts and evidence.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   An analyst has gathered multiple pieces of information for a hunt. After evaluating each piece, they decide to exclude a report that is not directly related to the hypothesis. Which step of the evaluation process does this action represent?

   • ADetermining the validity of the report's content.
   • BAssessing the reliability of the report's source.
   • CPrioritizing the report based on its severity score.
   • DApplying the process of elimination to remove irrelevant information.
   Reveal Solution Discussion Select an answer first