Analyze the Information Provided in a Hash Search CCFR Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   An analyst performs a Hash Search on a file and sees that the result indicates a 'malicious' reputation with high prevalence. What does the 'prevalence' value in the Hash Search results represent?

   • AThe severity score assigned to the file by Falcon's sandbox analysis
   • BThe number of malware families that the file is associated with
   • CThe number of times the file has been observed across Falcon's telemetry and intelligence sources
   • DThe number of endpoints in the customer's environment that have the file
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   Your Hash Search for a file returns a reputation of 'Unknown' and a prevalence score of 0. The file is found in a temporary directory on a user's workstation. What is the MOST appropriate conclusion?

   • AThe file has not been seen before by CrowdStrike's cloud, and further analysis is needed
   • BThe file is likely a false positive and can be ignored
   • CThe file is malicious because it is in a temporary directory
   • DThe file is benign because it has not been flagged as malicious
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   You are investigating a potential supply-chain attack. A Hash Search on a signed executable from a trusted vendor returns a 'Malicious' reputation. The file is signed with a valid certificate, and the prevalence is low. Your CISO is skeptical and wants to know if this is a real threat. What is the MOST compelling evidence from the Hash Search results to support the finding?

   • AThe file's low prevalence score, indicating it is not widely used
   • BThe file's associated malware family name, if listed
   • CThe file's valid digital signature from the trusted vendor
   • DThe 'Malicious' reputation, which is based on CrowdStrike's analysis of the file's content and behavior
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   You are analyzing a file that has a 'Malicious' reputation and a prevalence score of 1. The file is a DLL that is loaded by a legitimate, signed executable. What does the low prevalence score MOST likely suggest about the attack?

   • AThe DLL is a false positive because it is so rare
   • BThe DLL is a new variant of a known malware family
   • CThe attack is highly targeted, and the DLL may be custom-built for this specific victim
   • DThe attack is a widespread campaign using a single, common DLL
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   You are investigating a potential data exfiltration incident. A Hash Search on a file found on a compromised host returns a 'Suspicious' reputation with low prevalence. What is the MOST appropriate next step to determine if this file is related to the incident?

   • AConclude the file is benign because it is not rated as 'Malicious'
   • BImmediately quarantine the host to prevent further spread
   • CCorrelate the hash with other search tools and event data to find related processes, network connections, or file drops
   • DSearch for the file's MD5 hash to get a more definitive reputation
   Reveal Solution Discussion Select an answer first