A Bulk Domain Search returns a domain with a risk score of 70 and an associated indicator of a specific malware family. The analyst wants to confirm if any hosts in the environment have communicated with this domain. Which Falcon data source should the analyst query to correlate this information?

Network Connections and DNS requests from the Falcon sensor

Vulnerability management scan results

User activity logs from the identity protection module

An analyst is investigating a series of detections on multiple hosts. Bulk Domain Search flags 'malware-cdn.com' with a high risk score. The analyst wants to determine if this domain is the common link between the detections. Which approach would best establish this correlation?

Check the domain's WHOIS information for the registrant.

Run a vulnerability scan on the affected hosts.

Query Falcon for all events that reference 'malware-cdn.com' and compare the affected hosts with the detection list.

Block the domain and see if new detections stop.

An analyst is investigating a potential insider threat. Bulk Domain Search flags 'data-exfil.com' with a high risk score. The analyst wants to determine if any user accounts have been involved in uploading data to this domain. Which Falcon data sources should the analyst correlate?

Network connections from hosts and user login/logout events

Falcon Discover asset inventory and software list

Vulnerability scan results and patch history

Host isolation status and firewall rules

CrowdStrikeCertified Falcon Responder (CCFR)

Domain 5Objective 5

Analyze the Information Provided in a Bulk Domain Search CCFR Practice Questions (Page 3)

Part of the Search Tools domain, which makes up ~19% of our current practice bank.

24questions here

5free pages

4concepts

Questions 11–15

11application · medium
A Bulk Domain Search returns a domain with a risk score of 75 and an associated indicator of 'phishing'. The analyst wants to see if any users have received emails containing links to this domain. Which Falcon module would provide this information?
Select an answer first
12application · medium
A Bulk Domain Search returns a domain with a risk score of 70 and an associated indicator of a specific malware family. The analyst wants to confirm if any hosts in the environment have communicated with this domain. Which Falcon data source should the analyst query to correlate this information?
Select an answer first
13expert · hard
An analyst is investigating a series of detections on multiple hosts. Bulk Domain Search flags 'malware-cdn.com' with a high risk score. The analyst wants to determine if this domain is the common link between the detections. Which approach would best establish this correlation?
Select an answer first
14foundation · easy
A Falcon Responder runs a Bulk Domain Search and reviews the returned results. Which field in the result set directly indicates the likelihood that a domain is malicious?
Select an answer first
15expert · hard
An analyst is investigating a potential insider threat. Bulk Domain Search flags 'data-exfil.com' with a high risk score. The analyst wants to determine if any user accounts have been involved in uploading data to this domain. Which Falcon data sources should the analyst correlate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFR” is a trademark of its owner, used for identification only.

Analyze the Information Provided in a Bulk Domain Search CCFR Practice Questions (Page 3)

Questions 11–15

A Bulk Domain Search returns a domain with a risk score of 75 and an associated indicator of 'phishing'. The analyst wants to see if any users have received emails containing links to this domain. Which Falcon module would provide this information?

A Bulk Domain Search returns a domain with a risk score of 70 and an associated indicator of a specific malware family. The analyst wants to confirm if any hosts in the environment have communicated with this domain. Which Falcon data source should the analyst query to correlate this information?

An analyst is investigating a series of detections on multiple hosts. Bulk Domain Search flags 'malware-cdn.com' with a high risk score. The analyst wants to determine if this domain is the common link between the detections. Which approach would best establish this correlation?

A Falcon Responder runs a Bulk Domain Search and reviews the returned results. Which field in the result set directly indicates the likelihood that a domain is malicious?

An analyst is investigating a potential insider threat. Bulk Domain Search flags 'data-exfil.com' with a high risk score. The analyst wants to determine if any user accounts have been involved in uploading data to this domain. Which Falcon data sources should the analyst correlate?

Keep studying — Search Tools