Analyze the Information Provided in a Bulk Domain Search CCFR Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An analyst runs a Bulk Domain Search and finds a domain with a risk score of 90. The domain is associated with a specific malware family. The analyst wants to determine if any hosts in the environment are infected with that malware family. Which Falcon data should the analyst correlate?

   • AUser login logs from the identity provider
   • BDetection events that reference the malware family
   • CVulnerability scan results
   • DNetwork traffic logs from the firewall
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   A Bulk Domain Search reveals a domain with a high risk score that is not yet present in any detection. What is the most appropriate use of this information during incident response?

   • AReport it as a false positive
   • BImmediately block the domain on all endpoints
   • CTreat it as a potential threat and monitor for related activity
   • DDismiss it because there are no detections associated with it
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   A Falcon Responder finds a suspicious domain in a Bulk Domain Search and wants to see if any endpoints in the environment have communicated with it. Which Falcon feature should the responder use to correlate this information?

   • AInvestigate
   • BFalcon Discover
   • CFalcon Spotlight
   • DFalcon Overwatch
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A Bulk Domain Search flags 'evil-domain.net' with a high risk score. The analyst wants to see if any Falcon-detected events reference this domain. Which Falcon feature should the analyst use to perform this correlation?

   • AThe Hosts page to list all endpoints
   • BThe IOA exclusions page
   • CEvent Search with a query for the domain name
   • DThe Falcon Discover dashboard
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   During an investigation, an analyst runs a Bulk Domain Search on a list of domains observed in a phishing campaign. The results show that domain 'example-verify.com' has a risk score of 85, while 'example-update.net' has a risk score of 40. Both domains have similar creation dates and are hosted on the same IP. Which domain should the analyst prioritize for deeper investigation?

   • Aexample-verify.com, because the higher risk score indicates a greater likelihood of malicious activity.
   • BBoth equally, because they are hosted on the same IP and have similar creation dates.
   • CNeither, because Bulk Domain Search risk scores are not reliable for prioritization.
   • Dexample-update.net, because the lower risk score is more likely to be a false negative.
   Reveal Solution Discussion Select an answer first