Analyze the Information Provided in a User Search CCFR Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A Falcon administrator is investigating a security incident and needs to find all users who have the email domain 'legacy.com' and are also members of the 'Legacy Users' group. Which search parameters should be used?

   • AUsername: legacy, Group: Legacy Users
   • BEmail: @legacy.com, Department: Legacy
   • CEmail domain: legacy.com, Group: Legacy Users
   • DDomain: legacy.com, Title: Legacy User
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   During a User Search review, an analyst sees that a user 'tnguyen' has logged into a device that is assigned to a different department and has also accessed files outside of their normal working hours. What should the analyst do first?

   • AImmediately block the user's account.
   • BReport the user to HR for policy violation.
   • CIgnore the activity because the user may have a legitimate reason.
   • DFlag the activity as potentially anomalous and investigate further.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which user activity pattern should a responder investigate further as a potential threat?

   • AA user attempting to access multiple sensitive systems in a short time
   • BA user logging in once per day at the same time
   • CA user accessing a single file they need for their job
   • DA user accessing a shared drive used by their team
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the purpose of the export feature in Falcon's User Search?

   • ATo permanently delete the user data from Falcon
   • BTo automatically create a new user account in Falcon
   • CTo modify the user's permissions in the environment
   • DTo save the search results for offline analysis or sharing with other tools
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   During a User Search investigation, an analyst notices that a user account 'mwilson' has an unusually high number of failed login attempts across multiple devices in a short time window, followed by a successful login from a device not previously associated with the user. Which conclusion is most appropriate based on this activity?

   • AThe activity is normal and requires no action.
   • BThe user is likely testing a new device and the failures are irrelevant.
   • CThe user simply forgot their password and should be reminded to reset it.
   • DThe account may be compromised, and the analyst should investigate further.
   Reveal Solution Discussion Select an answer first