Analyze the Information Provided in a Bulk Domain Search CCFR Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In Bulk Domain Search results, what does a risk score of 0 typically indicate about a domain?

   • AThe domain is unknown and requires immediate investigation
   • BThe domain has no associated indicators
   • CThe domain is confirmed malicious
   • DThe domain is likely benign or has no observed malicious activity
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   During an incident, an analyst identifies a high-risk domain from Bulk Domain Search that is associated with C2 activity. The analyst finds that several hosts have communicated with the domain, but some are critical production servers that cannot be taken offline. What is the best containment approach?

   • ADo nothing because the critical servers cannot be taken offline.
   • BReimage the critical servers without blocking the domain.
   • CBlock the domain at the network level and monitor the critical servers for any further C2 activity.
   • DIsolate all affected hosts immediately, including critical servers.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A Bulk Domain Search returns a domain with a risk score of 65 and an associated indicator of 'phishing'. The domain is similar to a legitimate internal domain, but with a typo. The analyst suspects typosquatting. What additional data from the Bulk Domain Search result would help confirm this?

   • AThe domain's registration date and registrant information
   • BThe domain's risk score alone
   • CThe domain's IP address
   • DThe domain's associated indicators
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A Bulk Domain Search returns two domains: 'alpha.com' with a risk score of 90 and 'beta.com' with a risk score of 60. 'alpha.com' is a known legitimate service, while 'beta.com' is a newly registered domain with no reputation. The analyst has limited time and must choose which to investigate. What is the best course of action?

   • AInvestigate 'alpha.com' first because the higher risk score is the most reliable indicator.
   • BInvestigate both equally because risk scores are the only factor.
   • CSkip both because neither is definitively malicious.
   • DInvestigate 'beta.com' first because its lack of reputation and new registration may indicate higher risk despite the lower score.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   An incident responder is handling a suspected data exfiltration. Bulk Domain Search flags 'upload-data.com' with a risk score of 88 and an associated indicator of 'exfiltration'. The analyst finds that several hosts have communicated with this domain. The business owner insists the domain is a legitimate file-sharing service used for approved transfers. What should the analyst do to reconcile this conflict?

   • ACorrelate the domain communications with the timing and size of data transfers to determine if they align with the incident.
   • BBlock the domain immediately to stop potential exfiltration.
   • CIgnore the risk score and trust the business owner's assertion.
   • DRemove the domain from the investigation because it is approved.
   Reveal Solution Discussion Select an answer first