6.4 Identify Alternative Analytical Interpretations to Minimize and Reduce False Positives CCFH Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A hunt query flags a workstation that has been sending large volumes of data to an internal file share at 2:00 AM daily. The workstation belongs to a data analyst. Which alternative interpretation should the hunter evaluate to determine if this is a false positive?

   • AThe workstation is compromised and is staging data for exfiltration.
   • BThe file share is misconfigured and is replicating data to other servers.
   • CThe analyst has a scheduled backup job that runs nightly and copies files to the share.
   • DThe network is experiencing a broadcast storm causing inflated traffic statistics.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A Falcon Hunter sees a detection for a user running a script that downloads a file from a file-sharing site. The user is in the research department and the file-sharing site is commonly used by researchers to share large datasets. Which action BEST reduces the false positive?

   • AQuarantine the downloaded file without analysis.
   • BBlock the file-sharing site for the entire organization.
   • CEscalate the finding as a potential data exfiltration incident.
   • DVerify that the downloaded file matches the expected dataset for the user's current research project.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A Falcon Hunter is investigating a detection on a user's workstation. The detection shows the user downloading a file from a file-sharing site and then executing it. The user is in the sales department and is known to download sales templates from the site. However, the hunter notices that the file is a .exe, not a template. Which action BEST reduces the false positive while maintaining security?

   • ABlock the file-sharing site for the user immediately.
   • BAssume the download is benign because the user is in sales and uses the site regularly.
   • CEscalate the finding as a confirmed malware infection.
   • DCheck the file's reputation and hash against known malware databases before deciding.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A hunt detects a user launching PowerShell with a base64-encoded command. The user is in the IT department and the host is a domain controller. Which contextual factor would MOST reduce the likelihood of a false positive?

   • AThe PowerShell command was executed during business hours.
   • BThe host is a domain controller, which is a high-value target.
   • CThe user has local administrator rights on the host.
   • DThe user has a history of running similar PowerShell commands as part of their documented administrative duties.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A hunt detects a workstation that is communicating with a known malicious IP address. The workstation is a test machine used by the security team to analyze malware samples. Which alternative interpretation is MOST likely?

   • AThe IP address is a false positive in the threat intelligence feed.
   • BThe workstation is compromised and is being used as a botnet node.
   • CThe workstation is being used by an employee for personal browsing.
   • DThe test machine is intentionally connecting to the malicious IP as part of a malware analysis sandbox.
   Reveal Solution Discussion Select an answer first