3.4 Interpret Search Result Information Displayed in Dashboards to Determine Additional Investigation or Action CCFH Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security analyst is reviewing the 'Detections Summary' dashboard and sees a detection with a 'Critical' severity and a 'High' confidence score. The detection is for 'Ransomware' on a single endpoint. The 'Prevention' policy for that endpoint shows the action was 'Blocked'. The endpoint's last seen time in the dashboard is 2 minutes ago. What should the analyst do NEXT based on this dashboard information?

   • ACreate a new prevention policy for the endpoint to ensure future ransomware attempts are blocked.
   • BOpen the detection details to review the command line, parent process, and related events to determine if the block was effective and if any follow-up is needed.
   • CClose the detection as a false positive because the action was 'Blocked'.
   • DImmediately isolate the endpoint because the detection is critical and confidence is high.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A Falcon admin is reviewing the 'Vulnerability Management' dashboard and sees a widget showing 'Top Exploited CVEs'. The top CVE is 'CVE-2024-5678' with a 'Critical' severity and a 'Known Exploited' tag. The admin clicks on the CVE and sees that it affects 20 endpoints, all in the 'DMZ' group. The 'Patch' status shows 'Not Patched' for all 20. What is the MOST appropriate action based on this dashboard data?

   • AInvestigate the DMZ endpoints for signs of compromise before patching.
   • BIsolate the DMZ endpoints until they are patched.
   • CPrioritize patching the DMZ endpoints immediately because the CVE is critical and known to be exploited.
   • DWait for the next scheduled patch cycle to patch the DMZ endpoints.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An analyst is reviewing the 'Falcon X' dashboard and sees a widget showing 'Top Users with Detections'. The top user is 'jsmith' with 10 detections. The analyst clicks on 'jsmith' and sees that all 10 detections are for 'PUA.Win.Tool.Mikatz' (a known credential-dumping tool). The 'Last Seen' for the endpoint is 5 minutes ago. What is the MOST appropriate action based on this dashboard data?

   • AReview the detection details to confirm the activity is malicious and determine if the user's account or the endpoint is compromised.
   • BDisable the user's account immediately because they are clearly compromised.
   • CCreate a suppression rule for this user to reduce alert fatigue.
   • DIgnore the detections because the user is a known administrator who may use such tools legitimately.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A Falcon admin is reviewing the 'IOA (Indicators of Attack)' dashboard and sees a detection for 'Credential Dumping' on a domain controller. The detection has a 'Medium' severity and a 'Low' confidence score. The 'Prevention' action shows 'Blocked'. The admin also sees a related 'Detection' for 'Mimikatz' on the same endpoint with 'High' severity and 'High' confidence. What is the MOST appropriate interpretation of this dashboard data?

   • AThe detection is a false positive because the IOA has low confidence.
   • BThe IOA and the detection are related, and the combination of low-confidence IOA and high-confidence detection indicates a real credential-dumping attempt that was blocked.
   • CThe IOA is a false positive because the confidence is low, and the Mimikatz detection is the real threat.
   • DThe IOA is more important than the detection because it was blocked, so no further action is needed.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An analyst is reviewing the 'Event Dashboard' and sees a spike in 'Process Creation' events from a specific endpoint over the last 15 minutes. The events show a pattern of 'powershell.exe' spawning 'cmd.exe' repeatedly. The endpoint is a standard user workstation. What is the MOST appropriate next step based on this dashboard pattern?

   • AIsolate the endpoint immediately because the pattern is clearly malicious.
   • BOpen the Event Search to review the full command lines and parent processes to determine if this is a scripted attack or normal administrative activity.
   • CIgnore the pattern because PowerShell and CMD are common administrative tools.
   • DCreate a detection rule to alert on any PowerShell or CMD usage on this endpoint.
   Reveal Solution Discussion Select an answer first