Analyze Detection Information CCFR Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A Falcon administrator is reviewing the Endpoint detections list and sees hundreds of detections from the past 24 hours. The team has limited time to investigate and wants to focus on the most impactful threats first. The administrator needs to quickly identify detections that are both highly severe and actively spreading across multiple hosts. Which combination of filtering and sorting actions should the administrator use?

   • AGroup by hostname, then sort by the total number of detections per host in descending order.
   • BFilter by severity = Critical, then sort by the number of affected hosts in descending order.
   • CFilter by status = New, then sort by the detection timestamp in ascending order.
   • DFilter by tactic = Lateral Movement, then sort by the detection ID in ascending order.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   In the Endpoint security > Endpoint detections list, what does the 'Severity' column indicate?

   • AThe confidence that the detection is a true positive
   • BThe number of times the detection has been seen
   • CThe time it took to detect the activity
   • DThe potential impact of the detection on the organization
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A Falcon analyst is working through a detection that shows a single process making multiple outbound connections to different IP addresses on non-standard ports. The process is a known legitimate application that is used by the finance team. The analyst has verified the process hash is clean and the command line is typical. However, the detection is marked as 'High' severity. What is the most appropriate course of action?

   • AInvestigate the destination IPs and the context of the connections before deciding whether to contain the host.
   • BImmediately contain the host because the severity is High and the behavior is suspicious.
   • CMark the detection as a false positive because the process hash is clean and the command line is typical.
   • DUpdate the prevention policy to block the application from making outbound connections.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A SOC lead is reviewing the Activity dashboard and notices that the 'Detections by Tactic' visualization shows a sudden increase in 'Credential Access' detections over the past hour. The 'Detections by Host' visualization shows that these detections are spread across 15 different hosts, all in the HR department. What is the most likely interpretation?

   • AThe HR department is running a legitimate password-reset script that triggered the detections.
   • BThe detections are false positives caused by a recent software update in the HR department.
   • CThe HR department has a single compromised host that is generating alerts for all 15 hosts.
   • DAn attacker is attempting to compromise multiple HR workstations, possibly through a phishing campaign or credential harvesting.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A Falcon analyst is reviewing the Endpoint detections list and sees a detection with a severity of 'Low' and a status of 'New'. The affected host is a test server that is not in production. The analyst has limited time and must prioritize. Which action is most appropriate?

   • AContain the test server immediately to prevent any potential spread.
   • BDefer the detection and focus on higher-severity detections on production hosts.
   • CInvestigate the detection because it is new, even though the severity is low and the host is a test server.
   • DMark the detection as a false positive because the host is a test server.
   Reveal Solution Discussion Select an answer first