7.2 Perform Outlier Analysis with the Falcon Tool CCFH Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is an example of related telemetry that could provide context for an outlier process execution?

   • AThe number of active users in the organization.
   • BThe color scheme of the Falcon dashboard.
   • CThe version of the Falcon agent installed.
   • DThe command line arguments used to launch the process.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A Falcon hunter is reviewing a chart of outbound connection attempts over the past 30 days. The chart shows a flat, low-volume line for most days, but a single day shows a spike that is 10 times higher than the median. The hunter wants to understand the context of this spike. Which action would provide the most useful context?

   • AAdjust the chart's time range to show only the last 7 days to get a clearer view.
   • BClick on the spike in the chart to drill down into the individual connection events for that day.
   • CExport the chart as a PDF and share it with the incident response team.
   • DChange the chart's aggregation from daily to hourly to see if the spike is consistent.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   During an investigation, a Falcon hunter identifies a host that has been making connections to a rare external IP address at a consistent rate of 5 connections per minute for the past 3 hours. The host's baseline shows no previous connections to this IP. The hunter has confirmed the IP is not on any threat intelligence list. What is the most appropriate next step in the investigation?

   • ACompare the connection rate to the host's baseline for all outbound connections.
   • BAdd the IP to a blocklist to prevent further connections.
   • CReview the process on the host that is initiating the connections and check for any related scheduled tasks or services.
   • DClose the investigation because the IP is not on a threat intelligence list.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary benefit of using visualization tools like charts and graphs in Falcon for outlier analysis?

   • AThey make it easier to spot anomalies by presenting data in a visual format.
   • BThey provide a direct feed of threat intelligence.
   • CThey replace the need for search queries.
   • DThey automatically remediate detected outliers.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   When investigating an outlier event, which of the following is a key step to determine its cause and relevance?

   • AIgnoring the event if it is a false positive.
   • BImmediately blocking the affected host from the network.
   • CExamining related telemetry, such as process trees and user activity.
   • DDeleting the outlier event from the logs.
   Reveal Solution Discussion Select an answer first