6.6 Recognize Patterns Such as an Enterprise-Wide File Infection Process to Determine the Root Cause or Source of the Infection CCFH Practice Questions (Page 4)

Questions 16–19

1. 16foundation · easy

   A Falcon Hunter is analyzing an enterprise-wide file infection. Which of the following is most likely to be the root cause?

   • AA user opened a malicious email attachment on a single host that then spread to other hosts
   • BA server was rebooted after a scheduled maintenance window
   • CAn employee changed their password after a security awareness training
   • DA network switch was replaced due to hardware failure
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   During a root cause analysis, you find that the first encrypted file on the initial host was created by a process that was spawned by a scheduled task. The scheduled task was created by a user who had recently clicked a link in a phishing email. What is the most likely root cause?

   • AThe scheduled task was created by the operating system automatically.
   • BThe malware was already present and the scheduled task was a decoy.
   • CThe phishing email led to the creation of a scheduled task that executed the malware.
   • DThe scheduled task was created by a legitimate administrator for maintenance.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary purpose of using hunting queries to identify the source of an infection?

   • ATo determine the initial execution time, user, and process involved
   • BTo calculate the total number of affected hosts
   • CTo generate a list of all files that were deleted during the incident
   • DTo verify that all antivirus signatures are up to date
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following is the best example of an enterprise-wide file infection pattern?

   • AA malware variant modifies or encrypts files on thousands of hosts across the organization within hours
   • BA developer accidentally deletes a shared network drive
   • CA single user's document folder is encrypted after they open a phishing attachment
   • DA few hosts in one department have outdated antivirus definitions
   Reveal Solution Discussion Select an answer first