6.4 Identify Alternative Analytical Interpretations to Minimize and Reduce False Positives CCFH Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which approach is most effective for reducing false positives when a detection triggers on a known administrative script that runs daily?

   • ADisable the detection rule entirely to avoid future alerts.
   • BIncrease the severity of the detection to force more investigation.
   • CSuppress the detection for the specific script hash and command line pattern.
   • DIgnore all future alerts from that host.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A hunt detects a user accessing a known phishing URL from a corporate laptop. The user is in the marketing department and the URL is a link in a simulated phishing email sent by the security team. Which action BEST reduces the false positive?

   • AEscalate the finding to the incident response team as a confirmed compromise.
   • BBlock the user's access to all external websites.
   • CVerify that the user clicked the link in the simulated phishing email and did not enter credentials.
   • DReset the user's password immediately.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   During a hunt, an analyst observes repeated failed logon attempts followed by a successful logon for the same account. Which alternative interpretation should the analyst consider before concluding that this is a brute-force attack?

   • AThe failed attempts are always caused by malware running on the user's workstation.
   • BThe successful logon proves that the account was compromised.
   • CThe user may have forgotten their password and then typed it correctly.
   • DThe event is definitely a brute-force attack because the pattern matches the MITRE ATT&CK technique.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A detection flags a process that creates a scheduled task. Which contextual detail would most likely indicate this is a false positive?

   • AThe scheduled task was created by an administrator account.
   • BThe scheduled task is named after a known software update routine and runs from the vendor's installation directory.
   • CThe scheduled task runs with SYSTEM privileges.
   • DThe scheduled task executes a PowerShell script.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A hunt flags a server that is running a process that has not been seen before in the environment. The server is a newly deployed application server that was just put into production. Which alternative interpretation should the hunter consider FIRST?

   • AThe process is part of the newly deployed application and is expected to run on the server.
   • BThe process is a malicious implant that was installed during the deployment.
   • CThe process is a remnant of the server's initial configuration.
   • DThe process is a Windows system process that was not previously detected.
   Reveal Solution Discussion Select an answer first