7.2 Perform Outlier Analysis with the Falcon Tool CCFH Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which statistical method is commonly used in Falcon to identify outliers based on frequency deviations?

   • AHashing all event data to find duplicates.
   • BCorrelating events with known threat intelligence indicators.
   • CApplying machine learning models to predict future events.
   • DComparing event counts against a baseline to flag significant increases or decreases.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is a typical source of data for establishing a baseline of normal behavior in Falcon?

   • AHistorical telemetry from endpoints
   • BCompliance audit checklists
   • CNetwork firewall configuration files
   • DVendor threat intelligence reports
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A Falcon hunter is investigating a potential data exfiltration event. They want to identify all hosts that have uploaded more than 500 MB of data via HTTP in the last 24 hours, but only for hosts that typically upload less than 50 MB per day. Which combination of Falcon search and filtering actions would most efficiently isolate these outliers?

   • AQuery for all outbound connections and filter for those using port 80 or 443.
   • BFilter for HTTP upload events with a size greater than 500 MB, then compare the results against a saved baseline of each host's typical daily upload.
   • CSearch for all hosts with any HTTP activity and sort by total bytes uploaded in descending order.
   • DSearch for all HTTP upload events, then manually review each host's total upload volume.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A Falcon hunter has confirmed that an outlier event is a true positive—a host is running a previously unknown cryptocurrency miner. The hunter has isolated the host and wants to report the finding. Which reporting approach is most appropriate?

   • ADocument the event with the host name, the miner process, the detection method, and the containment actions taken.
   • BDelete the event from the Falcon console to clean up the environment.
   • CAdd the miner process to the host's baseline so it is not flagged again.
   • DVerbally inform the security team and take no further action.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A Falcon hunter is establishing a baseline for a group of domain controllers. The hunter notices that one domain controller has a significantly higher number of Kerberos authentication requests than the others, but this is consistent with its role as the primary authentication server. The hunter wants to avoid false positives while still detecting anomalies. Which baseline approach is most appropriate?

   • ACreate a separate baseline for each domain controller based on its own historical authentication volume.
   • BCreate a single baseline for all domain controllers using the average authentication request volume.
   • CExclude the primary authentication server from monitoring to avoid false positives.
   • DUse the company-wide average authentication volume as the baseline for all domain controllers.
   Reveal Solution Discussion Select an answer first