Analyze Detection Information CCFR Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   How does the View As Process Activity help correlate events with detection indicators?

   • ABy showing the user account, you can identify the attacker
   • BBy showing the exact order of events, you can see which indicator triggered the detection
   • CBy showing the parent-child relationships, you can see the attack chain
   • DBy showing the file hashes, you can identify malicious files
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An analyst is reviewing the Process Activity view for a detection. The view shows a series of events for a process, including file reads, registry queries, and a single network connection. The analyst wants to understand the purpose of the network connection. Which additional information from the Process Activity view would be most helpful?

   • AThe user account that ran the process.
   • BThe destination IP address and port of the network connection.
   • CThe registry keys that were queried.
   • DThe file path of the files that were read.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary purpose of the Endpoint security > Activity dashboard in Falcon?

   • ATo configure endpoint detection policies
   • BTo view detailed process trees for a single detection
   • CTo provide a high-level overview of endpoint activity and potential anomalies
   • DTo manage firewall rules for endpoints
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A Falcon administrator wants to identify detections that are part of a single campaign. The administrator suspects that a specific file hash is associated with the campaign. The Endpoint detections list contains thousands of detections. Which action would most efficiently identify all detections associated with this file hash?

   • ASort the detections by severity and manually review the high-severity items.
   • BUse the search or filter feature in the Endpoint detections list to filter by the file hash.
   • CExport the detections to a CSV file and search for the hash in a spreadsheet.
   • DGroup the detections by host and review the hosts with the most detections.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Why is contextual event data such as IP addresses and DNS queries important in a detection?

   • AIt is required to contain the host
   • BIt helps the responder understand the scope and nature of the activity
   • CIt is used to update the Falcon sensor
   • DIt automatically determines the severity of the detection
   Reveal Solution Discussion Select an answer first