Analyze the Information Provided in a Bulk Domain Search CCFR Practice Questions (Page 5)

Questions 21–24

1. 21foundation · easy

   During incident response, a Falcon Responder uses a Bulk Domain Search to identify domains associated with a phishing campaign. How should the responder use this information to inform the response?

   • AImmediately delete all emails containing the domains without further analysis
   • BIgnore the domains because they are not directly related to the incident
   • CBlock the domains in the firewall and consider them neutralized
   • DUse the domains as indicators to search for related activity across the environment
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   An analyst is triaging a large list of domains from Bulk Domain Search. The list includes domains with risk scores ranging from 10 to 95. The analyst has limited time and must focus on the most critical threats. The analyst notices that some domains with moderate scores (40-60) are associated with known malware families, while some high-score domains (80+) have no associated indicators. How should the analyst prioritize?

   • APrioritize domains with scores between 40 and 60, as they are most likely to be malicious.
   • BPrioritize the moderate-score domains with malware associations because they provide a clearer link to known threats.
   • CPrioritize the high-score domains because the risk score is the primary indicator of maliciousness.
   • DPrioritize domains with no indicators, as they are more likely to be false negatives.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A Bulk Domain Search result for 'update-service.com' shows a risk score of 60 and an associated indicator of 'malware'. The domain is not in any allowlist. The analyst wants to know if this domain is related to a recent detection on a host. What should the analyst do?

   • ARun a new Bulk Domain Search with a different domain list.
   • BCheck the domain's SSL certificate details.
   • CSearch Falcon for events that reference 'update-service.com' and correlate with the detection.
   • DAdd the domain to the allowlist to prevent future alerts.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   After a Bulk Domain Search flags a domain as high risk, a responder wants to see if any detections in the environment reference that domain. Which Falcon data source should the responder review to correlate this information?

   • ADetection details
   • BIOA (Indicator of Attack) definitions
   • CPrevention policies
   • DSensor update history
   Reveal Solution Discussion Select an answer first