4.4 Filter Event Data and Analyze Results CCFH Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   After filtering Event Search results for a specific process name, a hunter notices a large number of events from a single, rarely-used admin account. What is the most important initial conclusion to draw from this pattern?

   • AThe account is definitely compromised and requires immediate isolation.
   • BThe process is benign because it is running on a corporate machine.
   • CThe process is malicious because it is associated with a rarely-used account.
   • DThe activity is suspicious and warrants further investigation into the account's behavior.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   An analyst is looking at 'UserAccount' events and sees a user 'svc_backup' logging in from a new IP address at 3:00 AM. The user account is a service account. What is the most likely explanation?

   • AThe service account is performing a scheduled backup.
   • BThe event is a false positive and can be ignored.
   • CThe service account is being used for a legitimate administrative task.
   • DThe service account has been compromised and is being used by an attacker.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   After filtering for all process creation events (event_simpleName=ProcessRollup2) in the last 24 hours, an analyst notices a high volume of 'cmd.exe' executions from a single host. What is the most appropriate next step to determine if this is malicious?

   • ASearch for all events from that host without any filters to get the full picture.
   • BDelete the events from the search to reduce noise and focus on other hosts.
   • CFilter the results to show only cmd.exe events and correlate them with parent processes and command-line arguments.
   • DImmediately block the host's network traffic to contain the potential threat.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A threat hunter is investigating a potential privilege escalation. They have identified a 'ProcessRollup2' event where a process 'cmd.exe' was started by a process 'winlogon.exe'. What is the most likely interpretation?

   • AAn attacker has used a technique like 'PrintSpoofer' to escalate privileges.
   • BA user is running a command prompt from the login screen.
   • CThe process is a normal part of the Windows boot process.
   • DThe event is a false positive and can be ignored.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security team is investigating a potential data breach. They have identified a large number of 'FileRead' events from a sensitive folder on a server. The events are coming from a single user account. What is the most important next step?

   • AImmediately disable the user account.
   • BCheck if the user account has a history of accessing this folder.
   • CSearch for 'FileWrite' events to the same folder.
   • DIgnore the events because the user has legitimate access.
   Reveal Solution Discussion Select an answer first