Analyze Detection Information CCFR Practice Questions (Page 1)

Questions 1–5

1. 1application · easy

   In the Full Detection view, an analyst switches to the View As Process Table. The table shows multiple processes with columns for process name, command line, user, and start time. The analyst wants to identify which process was the first to execute in the attack chain. Which column should the analyst sort by to answer this question?

   • ACommand line
   • BUser
   • CProcess name
   • DStart time
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   In the Full Detection view, which of the following is typically displayed?

   • AA detailed timeline of events related to the detection
   • BA list of all users in the organization
   • CThe Falcon sensor version installed on the host
   • DA summary of all detections in the environment
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An analyst is examining a detection on a compromised web server. The Full Detection view shows the process tree and contextual data, including the source IP address of the attack, the DNS queries made by the malicious process, and a suspicious DLL dropped to disk. The analyst needs to determine the scope of the compromise. Which additional piece of contextual data would be most useful to assess whether the attacker gained a foothold on other hosts?

   • AThe timestamp of the first DNS query made by the malicious process.
   • BThe file hash of the dropped DLL.
   • CThe command line of the process that dropped the DLL.
   • DThe list of other hosts that communicated with the same source IP address.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A Falcon Responder is analyzing a detection. What is the FIRST step in the recommended Falcon detection analysis workflow?

   • AClose the detection as a false positive
   • BImmediately contain the affected host
   • CReview the detection details and associated contextual events
   • DEscalate the detection to a higher tier
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An analyst is using the View As Process Table to analyze a detection. The table shows a process named 'rundll32.exe' with a command line that includes a path to a DLL in the user's AppData folder. The process was started by 'user1' at 14:32:05. The analyst wants to determine if this process is related to other processes in the detection. Which column in the process table would be most useful for correlating this process with others?

   • AStart time
   • BParent process ID (PID)
   • CProcess name
   • DUser name
   Reveal Solution Discussion Select an answer first