6.4 Identify Alternative Analytical Interpretations to Minimize and Reduce False Positives CCFH Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A Falcon Hunter sees a process on a developer's workstation that is writing to a temp directory and then executing a file. The developer is known to use a build tool that compiles code in temp directories. Which alternative interpretation is MOST likely to explain the activity?

   • AThe build tool is compiling code and executing the output as part of the normal build process.
   • BThe process is a dropper that is installing malware on the workstation.
   • CThe process is a legitimate Windows update that is running in the temp directory.
   • DThe temp directory is a sign of a ransomware attack staging files.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   An alert fires for a user accessing a sensitive file share from an unusual IP address. Which contextual information would be most useful to determine if this is a false positive?

   • AThe user's job title alone.
   • BThe user's favorite food.
   • CThe color of the user's laptop.
   • DWhether the user is currently on approved travel and the IP address belongs to the hotel network.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A Falcon Hunter sees a spike in DNS queries from a single engineering workstation to a domain that was registered 48 hours ago. The workstation is a build server that runs nightly automated tasks. Which alternative interpretation should the hunter consider FIRST before escalating?

   • AThe domain is a known command-and-control (C2) infrastructure and the workstation is compromised.
   • BThe workstation is being used by an attacker to perform DNS tunneling.
   • CThe DNS spike is caused by a misconfigured DNS resolver on the network.
   • DThe build server is running a scheduled task that checks for software updates from a newly configured vendor repository.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A Falcon Hunter is investigating a detection on a domain controller. The detection shows a PowerShell script that creates a new local user account. The organization has a policy that prohibits local accounts on domain controllers. However, the hunter discovers that a recent change request was approved to create a local account for a legacy application. Which action BEST balances the need to reduce false positives with the need to maintain security?

   • ATreat the detection as a confirmed compromise because the policy prohibits local accounts.
   • BDelete the local account immediately to enforce the policy.
   • CVerify the script's hash against the approved change request and confirm the account name matches the request.
   • DEscalate the finding to the incident response team without further analysis.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   A hunting query flags any process that uses PowerShell to download a file. Which method would best reduce false positives while still detecting potentially malicious downloads?

   • AOnly look for PowerShell downloads that occur at night.
   • BRemove PowerShell from the query entirely.
   • CIncrease the frequency of the query to catch more events.
   • DRefine the query to require additional indicators, such as a suspicious domain or encoded command.
   Reveal Solution Discussion Select an answer first