5.2 Use the Built-In Visibility Reports to Refine Event Details CCFH Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An analyst is reviewing the Network Connections report and sees a single host making repeated connections to a cloud storage provider. The analyst wants to determine if the connections are from a legitimate backup process or from malware. The current report shows source and destination IPs and ports. What is the most effective next step within the report to gather more context?

   • ASwitch to the User Activity report to see which user initiated the connections.
   • BExport the report to CSV and review the destination ports in a spreadsheet.
   • CDrill down into one of the connection events to view the process name and command line.
   • DFilter the report to show only connections to the cloud provider's IP range.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   While reviewing the Network Connections report, an analyst notices a large volume of connections from a single host to a rarely-used database server. The analyst needs to determine whether these connections are legitimate by examining the specific process that initiated them. The current report view shows only source IP, destination IP, and port. What should the analyst do next within the report to see the process details?

   • AApply a filter to show only connections to the database server's port.
   • BSwitch to the User Activity report to see the process details.
   • CExport the report to CSV and open it in a text editor.
   • DDrill down into an individual connection event to view the associated process details.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An incident responder is investigating a data exfiltration incident. The responder has identified a suspicious user account and needs to see all files that this user accessed on a specific file server between 14:00 and 15:00 yesterday. The responder is currently in the User Activity report. Which filter combination will produce the required file access events?

   • AFilter by hostname and time range only, then look for file access event types.
   • BFilter by username and hostname only, then look for file access event types.
   • CFilter by username, hostname, and time range, then look for file access event types.
   • DFilter by username and time range only, then export the results.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which file format can be used to export a Visibility report for further analysis in a spreadsheet application?

   • AJSON
   • BCSV
   • CXML
   • DPDF
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary purpose of the Visibility reports in Falcon?

   • ATo provide a high-level summary of detections and alerts
   • BTo display detailed event data for investigation and analysis
   • CTo manage Falcon platform configurations and settings
   • DTo generate compliance and audit documentation
   Reveal Solution Discussion Select an answer first