Analyze the Information Provided in a Hash Search CCFR Practice Questions (Page 4)

Questions 16–17

1. 16application · medium

   You are investigating a host that has been exhibiting suspicious network behavior. You find a file and run a Hash Search, which returns a 'Malicious' reputation. What is the MOST important next step to confirm the file is the cause of the behavior?

   • ACheck the host's Event Search data for processes associated with this file's execution
   • BReview the file's prevalence score to determine if it is a common threat
   • CIsolate the host from the network immediately
   • DSearch for the file's MD5 hash to see if it has a different reputation
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   During an investigation, you find a DLL on a server that is not present in your organization's approved software list. A Hash Search returns a 'Suspicious' reputation. The DLL is signed by a legitimate, well-known software vendor. How should you weigh these findings?

   • AThe file is likely benign because it is signed, and the 'Suspicious' reputation is a false positive
   • BThe legitimate signature overrides the 'Suspicious' reputation, so the file is likely benign
   • CThe 'Suspicious' reputation and valid signature indicate a need for further investigation into the file's behavior and origin
   • DThe 'Suspicious' reputation overrides the signature, so the file is definitely malicious
   Reveal Solution Discussion Select an answer first