7.2 Perform Outlier Analysis with the Falcon Tool CCFH Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A Falcon hunter notices that a specific PowerShell process has been spawned 15 times in the last 10 minutes on a single host, whereas the host typically runs PowerShell 2–3 times per day. The hunter wants to determine if this frequency deviation is malicious. Which next step is most aligned with the outlier analysis methodology?

   • AReview the process tree for each PowerShell instance to see what parent process spawned it and what command-line arguments were used.
   • BBlock PowerShell execution on the host to prevent further instances from running.
   • CSearch for all PowerShell events across the entire environment to see if other hosts are affected.
   • DCompare the host's PowerShell frequency to the company-wide average to confirm the outlier.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is an example of a structured way to report an outlier finding for escalation?

   • AA verbal description of the event without any details.
   • BA raw log dump of all events from the past month.
   • CA screenshot of the Falcon dashboard without annotations.
   • DA summary that includes the entity, the deviation observed, and the recommended next steps.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   In the context of Falcon, what is the primary purpose of outlier analysis?

   • ATo identify events or behaviors that deviate significantly from an established norm, potentially indicating malicious activity.
   • BTo automatically remediate all detected threats without analyst intervention.
   • CTo provide a summary of all events that match known indicators of compromise (IOCs).
   • DTo replace the need for threat intelligence feeds by generating all detections from baseline data.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the purpose of establishing a baseline of normal behavior for entities such as users, hosts, and processes?

   • ATo replace the need for threat intelligence in the hunting process.
   • BTo provide a reference point against which deviations can be identified as potential outliers.
   • CTo ensure that all user activity is logged for compliance purposes.
   • DTo automatically block all activity that does not match the baseline.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A Falcon hunter is analyzing a user account that has logged in from 3 different countries in the past hour. The user's baseline shows logins from a single country, typically during business hours. The hunter wants to determine if this is a compromised account. Which analysis approach is most appropriate?

   • AImmediately disable the user account to prevent further access.
   • BReview the authentication events for the user to see if multi-factor authentication (MFA) was satisfied and whether the logins came from known or unknown devices.
   • CSearch for other users who have logged in from the same countries to see if it is a pattern.
   • DCompare the user's login locations to the company's VPN exit nodes to see if the locations match.
   Reveal Solution Discussion Select an answer first