3.4 Interpret Search Result Information Displayed in Dashboards to Determine Additional Investigation or Action CCFH Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   A Falcon Hunter is reviewing a dashboard that displays search results for a specific detection. The dashboard shows a high number of hits for a particular process name, but the process is also present in a large number of unrelated, benign endpoints across the environment. What is the most appropriate initial interpretation of this dashboard data?

   • AThe dashboard data is insufficient to draw any conclusion, so the search should be discarded.
   • BThe process is likely benign, and no further investigation is needed.
   • CThe high hit count suggests a potential false positive or a benign process, warranting further investigation to correlate with other indicators.
   • DThe process is definitively malicious and should be blocked immediately across all endpoints.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A Falcon admin is reviewing the 'Detections' dashboard and sees a detection for 'Lateral Movement' on an endpoint in the 'HR' group. The detection has a 'High' severity and a 'High' confidence score. The 'Prevention' action shows 'Blocked'. The admin also sees a related 'IOA' for 'Remote Service Creation' on the same endpoint with a 'Medium' severity and a 'Medium' confidence score. The 'Event Dashboard' shows a spike in 'New User Account Created' events on the same endpoint. What is the MOST appropriate interpretation of this dashboard data?

   • AThe lateral movement was blocked, and the new user account is likely a false positive because the IOA has medium confidence.
   • BThe new user account is the most important signal, and the admin should disable it immediately.
   • CThe lateral movement detection is a false positive because the IOA has medium confidence.
   • DThe combination of the high-confidence lateral movement detection, the IOA for remote service creation, and the new user account events indicates a multi-stage attack that was partially blocked, and the admin should investigate the new account for persistence.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   While reviewing a dashboard that summarizes search results for a specific host, a Falcon Hunter notices that the 'Unique Events' count is significantly higher than the 'Unique Processes' count. What is the most reasonable interpretation of this dashboard data?

   • AThe dashboard is displaying incorrect data, and the search should be re-run.
   • BThe host is compromised, and the high event count indicates a severe infection.
   • CThe host is idle, and the high event count is due to background system processes that can be ignored.
   • DThe host is generating many distinct events, but they are likely originating from a limited set of processes, suggesting the need to drill down into the event details.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A Falcon admin is reviewing the 'Vulnerability Management' dashboard and sees a widget showing 'Top CVEs by Endpoint Impact'. The top CVE is 'CVE-2023-1234' affecting 50 endpoints. The admin clicks on the CVE and sees that 45 of the affected endpoints are in the 'Production' group and 5 are in the 'Development' group. The 'Patch' status shows 'Not Patched' for all 50. What is the MOST appropriate action based on this dashboard data?

   • AInvestigate the 5 Development endpoints first to determine if they are internet-facing.
   • BPrioritize patching the 45 Production endpoints first because the vulnerability affects more critical systems.
   • CPrioritize patching the 5 Development endpoints first because they are often less protected.
   • DWait for the next scheduled patch cycle to patch all 50 endpoints at once.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A Falcon administrator reviews the Dashboards > Falcon X page and sees a spike in the 'Unique Endpoints with Detections' widget over the past 24 hours. The spike is driven by a single detection family (e.g., 'PUA.Win.Tool.TechSupport'). The administrator clicks into the detection family and sees 40 detections across 35 endpoints. Most detections are on endpoints in the 'Marketing' group, but 5 are on endpoints in the 'Finance' group. What is the MOST appropriate next step based on this dashboard data?

   • AImmediately isolate all 35 endpoints to contain the potential malware outbreak.
   • BCreate a suppression rule for the detection family across all groups to reduce alert fatigue.
   • CInvestigate the Finance group detections separately, as they may indicate a different infection vector or lateral movement from Marketing.
   • DIgnore the Finance detections because the volume is low compared to Marketing.
   Reveal Solution Discussion Select an answer first