7.2 Perform Outlier Analysis with the Falcon Tool CCFH Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which statement best describes the role of outlier analysis in the Falcon hunting methodology?

   • AIt is a reporting tool that generates executive summaries of all security incidents.
   • BIt is a reactive measure that only activates after a confirmed breach has been reported.
   • CIt is a compliance requirement that mandates specific alerts for every deviation from baseline.
   • DIt is a proactive technique used to surface unusual activity that may indicate a threat, guiding further investigation.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   A Falcon hunter wants to isolate events that deviate from normal baselines. Which Falcon capability is most directly used for this purpose?

   • AEndpoint detection and response (EDR) alerts
   • BAutomated incident response playbooks
   • CReal-time threat intelligence feeds
   • DSearch and filtering
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the purpose of documenting outlier findings in a structured manner?

   • ATo automatically generate threat intelligence feeds.
   • BTo enable further analysis and escalation by providing a clear record of the investigation.
   • CTo replace the need for incident response plans.
   • DTo satisfy legal requirements for data retention.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which heuristic method is used in Falcon to identify outliers based on pattern deviations?

   • ABlocking all events that match a known malware signature.
   • BCorrelating events with external threat feeds.
   • CEncrypting all event data to prevent tampering.
   • DFlagging events that do not match known behavioral patterns of the entity.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A Falcon hunter has completed an investigation of an outlier event and determined that a developer's host was running a legitimate but unusual build script that caused a spike in CPU usage. The hunter needs to document this finding for the security team. Which documentation approach is most appropriate?

   • AAdd the build script to the host's baseline so future spikes are not flagged.
   • BDelete the event from the Falcon console to keep the environment clean.
   • CRecord the event as a false positive with a note that the build script is a known legitimate process.
   • DEscalate the event to the incident response team for further analysis.
   Reveal Solution Discussion Select an answer first