6.4 Identify Alternative Analytical Interpretations to Minimize and Reduce False Positives CCFH Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A Falcon Hunter identifies a process on a finance user's laptop making repeated connections to a foreign IP address. The user is currently traveling internationally and is connected to a hotel Wi-Fi network. Which action BEST reduces the false positive while maintaining hunt effectiveness?

   • AImmediately block the foreign IP address at the firewall.
   • BCorrelate the connections with the user's travel itinerary and the hotel's public IP geolocation.
   • CIgnore the alert because the user is traveling.
   • DIsolate the laptop from the network to prevent potential data exfiltration.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A Falcon Hunter sees a detection for a known malware signature on a server. The server is a honeypot deployed by the security team. Which contextual factor is MOST important in evaluating this detection?

   • AThe server is a honeypot, so the detection is expected and likely a false positive for a real compromise.
   • BThe server has not been patched in 90 days.
   • CThe server is in a DMZ, which is a higher-risk network segment.
   • DThe malware signature is very recent, indicating a new threat.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A Falcon Hunter is investigating a detection on a user's workstation. The detection shows the user accessing a website that is categorized as 'malicious' by the web filter. The user is in the legal department and is researching a case involving a website that was used in a phishing attack. Which action BEST reduces the false positive while maintaining security?

   • ABlock the website for the user immediately to prevent potential compromise.
   • BAssume the access is malicious because the website is categorized as malicious.
   • CEscalate the finding to the incident response team as a confirmed compromise.
   • DVerify the user's research need by checking the case files and the website's relevance to the investigation.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A Falcon Hunter sees a detection for a user accessing a database with a large number of queries in a short time. The user is a data scientist who is running a machine learning model that queries the database for training data. Which alternative interpretation is MOST likely?

   • AThe database is misconfigured and is causing query loops.
   • BThe user is running a performance test on the database.
   • CThe data scientist is running a legitimate machine learning job that requires extensive database queries.
   • DThe user's account is compromised and the attacker is exfiltrating the database.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A hunt flags a server that is making outbound connections to a cloud storage provider at regular intervals. The server is a web application server that hosts a public-facing site. Which contextual factor would MOST reduce the false positive?

   • AThe cloud storage provider is a well-known company.
   • BThe connections occur during off-peak hours.
   • CThe server has been running for over a year without any security incidents.
   • DThe web application uses the cloud storage provider for storing user-uploaded content.
   Reveal Solution Discussion Select an answer first