Analyze the Information Provided in a Hash Search CCFR Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   You are investigating a host that has been beaconing to a known malicious IP. You find a file in the startup folder and run a Hash Search. The result is 'Suspicious' with low prevalence. What should you do NEXT?

   • AConclude the file is benign because it is only 'Suspicious'
   • BCorrelate the file's execution with the network beaconing in Event Search
   • CImmediately delete the file from the host
   • DRun a Hash Search on the file's SHA1 hash to get a different result
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   During an incident investigation, an analyst finds a file hash and wants to determine if the file is known malicious. Which Falcon tool is most appropriate for this initial check?

   • AHash Search
   • BEvent Search
   • CIOA (Indicator of Attack) Search
   • DHost Search
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   A Falcon analyst needs to search for a file by its hash. Which of the following hash algorithms does the Hash Search tool in Falcon support?

   • ASHA256 only
   • BCRC32 and MD5
   • CMD5 and SHA1 only
   • DMD5, SHA1, and SHA256
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A Hash Search on a file returns a 'Malicious' reputation, but the file is a signed Microsoft executable. You suspect a DLL side-loading attack. What is the MOST important next step to confirm this?

   • ACheck the file's digital signature details to see if it is a valid Microsoft signature
   • BSearch for the file's MD5 hash to see if the reputation changes
   • CCheck the file's prevalence score to see if it is a common Microsoft file
   • DInvestigate the file's behavior, such as which DLLs it loads and its network connections
   Reveal Solution Discussion Select an answer first
6. 5application · easy

   You have a hash from a third-party sandbox that is not in MD5, SHA1, or SHA256 format. Can you use Falcon's Hash Search to look it up?

   • ANo, you must obtain the file itself to run a Hash Search
   • BNo, you must first convert the hash to a supported format
   • CYes, but the results will be less accurate
   • DYes, the Hash Search tool accepts any hash format
   Reveal Solution Discussion Select an answer first