5.2 Use the Built-In Visibility Reports to Refine Event Details CCFH Practice Questions (Page 3)

Questions 11–15

1. 11application · easy

   A new junior analyst on the security team needs to review a list of all hosts that have communicated with a known-bad IP address over the last 7 days. The analyst has never used the Falcon console before and asks where to find this information. Which navigation path and report should the analyst be directed to?

   • ANavigate to the Detections page and look for the bad IP address in the detection list.
   • BNavigate to the IOA Exclusions page and search for the bad IP address.
   • CNavigate to the Visibility reports section and open the Network Connections report, then filter by the bad IP address.
   • DNavigate to the Hosts management page and search for the bad IP address.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   An incident responder is examining a Network Connections report and sees a host communicating with an IP address that is flagged as malicious by threat intelligence. The responder needs to determine whether the connection was initiated by a legitimate application or by malware. The report currently shows source IP, destination IP, and port. What is the most effective way to gather the necessary evidence?

   • ACheck the Detection Summary report to see if the connection triggered an alert.
   • BDrill down into the specific connection event to view the process name, command line, and parent process.
   • CSwitch to the User Activity report to see which user was logged on at the time of the connection.
   • DFilter the report to show only connections to the malicious IP, then export the results.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An analyst is reviewing the Network Connections report and notices a host making connections to a known malicious IP. The analyst needs to see the full details of one of these connections, including the process that initiated it and the user context. The current report view shows only the source and destination IPs. What should the analyst do?

   • AApply a filter for the malicious IP and export the results to CSV.
   • BSwitch to the User Activity report to see the user context.
   • CCheck the Detection Summary report for an alert related to the connection.
   • DClick on the specific connection event to open its full details.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   A security team needs to share a Visibility report with a colleague who does not have Falcon access. What is the best way to provide the data?

   • ACopy and paste the report URL into an email
   • BExport the report to CSV or PDF and share the file
   • CSend the colleague a direct link to the report in Falcon
   • DTake a screenshot of the report and email it
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   An analyst wants to view only login events from the last 24 hours in the Login Activity Report. Which filter should they apply?

   • AAn event type filter set to 'Logon'
   • BA time range filter set to 'Last 24 hours'
   • CA host filter set to 'All hosts'
   • DA user filter set to 'Current user'
   Reveal Solution Discussion Select an answer first