Analyze Detection Information CCFR Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which of the following is an example of contextual event data available in a Falcon detection?

   • AThe number of endpoints in the environment
   • BDNS queries made by the affected host
   • CThe Falcon sensor version installed on the host
   • DThe name of the Falcon customer account
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the primary purpose of the Full Detection view?

   • ATo display the detection's status in the workflow
   • BTo provide a comprehensive view of the activity to support response decisions
   • CTo allow you to edit detection policies
   • DTo show a list of all endpoints in the environment
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   While analyzing a detection in the Full Detection view, an analyst switches to the Process Activity tab. The analyst sees a chronological list of events for a single process, including file creations, registry modifications, and network connections. The analyst notices that the process created a file in the startup folder before making a network connection. What does this sequence of events most likely indicate?

   • AThe registry modification was the primary malicious action, and the file creation was incidental.
   • BThe process established persistence on the host before attempting to communicate externally.
   • CThe process was performing routine administrative tasks, and the events are unrelated to the detection.
   • DThe network connection was the initial infection vector, and the file creation was a consequence of the connection.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security operations center (SOC) manager reviews the Endpoint security > Activity dashboard for the past week. The dashboard shows a steady baseline of approximately 50 detections per day. On Tuesday, the count spiked to 400 detections, and on Wednesday it returned to 50. The manager also sees that the spike was driven by a single detection pattern affecting 300 hosts. What is the most appropriate initial interpretation of this data?

   • AA single host was compromised on Tuesday and the detection count reflects repeated alerts from that one host.
   • BThe detection system was malfunctioning on Tuesday and generated duplicate alerts that were not real.
   • CA widespread event occurred on Tuesday, likely a single campaign or a false positive triggered by a software update, and it was contained by Wednesday.
   • DThe SOC was understaffed on Tuesday, leading to a backlog of unprocessed detections that cleared by Wednesday.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   An analyst is in the Full Detection view for a detection on a file server. The Process Tree shows: services.exe → wmiprvse.exe → powershell.exe. The powershell.exe process executed a script that created a new local user account and added it to the Administrators group. The analyst also sees that the script made a network connection to an internal IP address on port 445. What is the most appropriate immediate response?

   • AContain the file server to prevent further lateral movement and credential abuse.
   • BBlock the internal IP address on port 445 in the firewall.
   • CDelete the newly created user account and remove it from the Administrators group.
   • DReboot the file server to clear the malicious processes from memory.
   Reveal Solution Discussion Select an answer first