Analyze the Information Provided in a Bulk Domain Search CCFR Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A Bulk Domain Search result for 'cdn-fast.net' shows a risk score of 30 and an associated indicator of 'none'. The domain is used by a legitimate CDN service. The analyst is investigating a malware outbreak and wants to rule out this domain. What should the analyst do?

   • ABlock the domain immediately because it appears in the search results.
   • BAdd the domain to the allowlist to prevent any future alerts.
   • CIgnore the domain completely because it is a known CDN.
   • DTreat the domain as low risk and deprioritize it, but verify if any hosts have connected to it.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   During incident response, an analyst runs a Bulk Domain Search on a list of domains extracted from a compromised host's DNS cache. One domain has a risk score of 95 and is associated with a known C2 framework. The analyst needs to determine the scope of the incident. What should the analyst do next?

   • ABlock the domain in the firewall immediately to prevent further communication.
   • BCheck the domain's WHOIS records for the registrant's identity.
   • CRe-run the Bulk Domain Search with a higher risk score threshold.
   • DSearch Falcon for any other hosts that have resolved or connected to that domain.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An analyst reviews a Bulk Domain Search result for 'legit-site.com'. The result shows the domain name, a risk score of 20, and an associated indicator of 'phishing'. The domain is a well-known legitimate service. How should the analyst interpret this result?

   • AThe risk score of 20 is high enough to warrant blocking the domain.
   • BThe low risk score suggests the phishing indicator is likely a false positive or a subdomain issue.
   • CThe result is invalid because legitimate domains cannot have phishing indicators.
   • DThe phishing indicator overrides the risk score, so the domain should be treated as malicious.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   While reviewing Bulk Domain Search results, a responder sees a domain listed along with several file hashes and IP addresses. What are these additional items called in the context of the search results?

   • AAssociated indicators
   • BDetection summaries
   • CReputation labels
   • DRisk factors
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   During an incident, an analyst identifies a high-risk domain from Bulk Domain Search that is associated with a C2 server. The analyst needs to contain the threat. What should the analyst do first?

   • AIdentify all hosts that have communicated with the domain using Falcon data.
   • BDelete the domain from the Bulk Domain Search list.
   • CRun a vulnerability scan on all hosts.
   • DBlock the domain at the firewall immediately.
   Reveal Solution Discussion Select an answer first