Analyze Detection Information CCFR Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A junior analyst is reviewing the Endpoint detections list and sees a detection with a severity of 'Medium' and a status of 'New'. The affected host is a domain controller. The analyst is unsure whether to escalate this detection. Which additional information from the detections list would most strongly justify escalating this Medium-severity detection?

   • AThe detection is associated with a known malicious file hash.
   • BThe affected host has a low number of total detections.
   • CThe detection is the only one currently in the 'New' status.
   • DThe detection was created more than 24 hours ago.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What does the View As Process Activity primarily display?

   • AA hierarchical tree of process relationships
   • BA list of all files on the host
   • CA chronological list of events related to the processes
   • DA summary of all detections on the host
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the purpose of grouping detections in the Falcon console?

   • ATo automatically contain all affected hosts
   • BTo organize detections by common attributes, such as host or detection type
   • CTo permanently delete multiple detections at once
   • DTo change the severity of multiple detections
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Why is the process tree useful for identifying malicious activity chains?

   • AIt shows the exact time each process started
   • BIt shows how a malicious process was launched by another process
   • CIt shows the user who ran each process
   • DIt shows the network connections of each process
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   In the View As Process Tree, what does the tree structure primarily show?

   • AThe file hashes of all executables
   • BThe network connections made by each process
   • CParent-child relationships between processes
   • DThe chronological order of all events
   Reveal Solution Discussion Select an answer first