An analyst sees a process spawning cmd.exe and then making an outbound network connection. Which alternative interpretation should be considered before labeling this as command-and-control (C2) activity?

The process might be a legitimate administrative script that uses cmd.exe to run a scheduled task.

The outbound connection is always malicious because cmd.exe is rarely used legitimately.

The process spawning cmd.exe is a direct indicator of a specific malware family.

The network connection is proof that data exfiltration is occurring.

CrowdStrikeCertified Falcon Hunter (CCFH)

Domain 6Objective 4

6.4 Identify Alternative Analytical Interpretations to Minimize and Reduce False Positives CCFH Practice Questions (Page 5)

Part of the Hunting Analytics domain, which makes up ~25% of our current practice bank.

21questions here

5free pages

3concepts

Questions 21–21

21foundation · easy
An analyst sees a process spawning cmd.exe and then making an outbound network connection. Which alternative interpretation should be considered before labeling this as command-and-control (C2) activity?
Select an answer first

Finished these 1 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CCFH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFH” is a trademark of its owner, used for identification only.

6.4 Identify Alternative Analytical Interpretations to Minimize and Reduce False Positives CCFH Practice Questions (Page 5)

Questions 21–21

An analyst sees a process spawning cmd.exe and then making an outbound network connection. Which alternative interpretation should be considered before labeling this as command-and-control (C2) activity?

Keep studying — Hunting Analytics