Analyze the Information Provided in a Hash Search CCFR Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary purpose of the Hash Search tool in Falcon?

   • ATo generate a hash for a file that is not yet known to Falcon
   • BTo compare two files to determine if they are identical
   • CTo block all files that match a given hash from executing on endpoints
   • DTo identify files across the environment by their unique hash and provide associated reputation and prevalence data
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   An analyst uses Hash Search and finds that a file is 'suspicious' but not definitively malicious. How should the analyst proceed to further investigate the file?

   • ASubmit the hash to a public malware repository for a second opinion
   • BUse Event Search to look for detections or activity associated with the hash
   • CDelete the file from all endpoints immediately
   • DIgnore the file because it is not confirmed malicious
   Reveal Solution Discussion Select an answer first
4. 8application · easy

   A file on an endpoint has been flagged by the Falcon sensor, but you do not have its SHA256 hash. You only have its MD5 hash from a third-party tool. Can you use Falcon's Hash Search to look up this file?

   • AYes, but only if you convert the MD5 hash to SHA256 first
   • BNo, the Hash Search tool only works with hashes collected by the Falcon sensor
   • CNo, you must have the SHA256 hash to use the Hash Search tool
   • DYes, the Hash Search tool supports MD5, SHA1, and SHA256 hashes
   Reveal Solution Discussion Select an answer first
5. 9application · easy

   You are investigating a file that was flagged by the Falcon sensor. You have the file's SHA256 hash. What is the PRIMARY purpose of running a Hash Search on this hash?

   • ATo identify the user who downloaded the file
   • BTo determine the file's creation timestamp on the endpoint
   • CTo find the file's original download URL
   • DTo determine if the file is known to CrowdStrike's threat intelligence and obtain its reputation
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   In the Hash Search results, which of the following pieces of information is typically provided to help an analyst understand the file's reputation?

   • AThe IP address of the server that originally hosted the file
   • BThe file's creation timestamp on the local endpoint
   • CA verdict such as 'malicious', 'suspicious', or 'known good'
   • DThe name of the user who first executed the file
   Reveal Solution Discussion Select an answer first