Analyze the Information Provided in a User Search CCFR Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which type of data would you expect to retrieve when performing a User Search in Falcon?

   • AUser account attributes, associated devices, and recent activity
   • BEmail quarantine status and message delivery logs
   • CEndpoint configuration and installed software inventory
   • DFirewall rule changes and network policy modifications
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   When viewing User Search results in Falcon, which of the following would you expect to see for a specific user?

   • AThe full contents of the user's email mailbox
   • BA list of devices associated with the user
   • CThe user's complete browsing history
   • DThe user's password hash and authentication tokens
   Reveal Solution Discussion Select an answer first
4. 3expert · medium

   An analyst is reviewing User Search results for a user 'jdoe' and sees that the user has logged into a device that is marked as 'lost' or 'stolen' in the asset management system. The user has also accessed sensitive data on that device. What is the most appropriate immediate action?

   • AIgnore the activity because the device may have been recovered.
   • BIsolate the device from the network and revoke the user's access to sensitive data.
   • CContact the user to ask if they have the device.
   • DDisable the user's account immediately.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A Falcon administrator is looking for a user account that was created recently. The administrator knows the user's email is 'newhire@company.com' but is not sure of the username. What is the most efficient way to find this account in User Search?

   • ASearch by the username 'newhire'.
   • BSearch by the domain 'company.com' and sort by creation date.
   • CSearch by the email address 'newhire@company.com'.
   • DSearch by the full name 'New Hire'.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An analyst is reviewing User Search results for a user 'bkim' and sees that the user has multiple devices listed, but one device shows a 'last seen' date that is over a year old. What does this indicate?

   • AThe device is likely decommissioned or no longer in use.
   • BThe device is a virtual machine that is always on.
   • CThe device is actively being used but not reporting.
   • DThe user has been compromised on that device.
   Reveal Solution Discussion Select an answer first