Analyze the Information Provided in a User Search CCFR Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A Falcon administrator is searching for a user by the name 'Alex Johnson' but is unsure whether the username is 'ajohnson' or 'alex.j'. The administrator wants to find all possible accounts that could belong to this person. Which search approach is most effective?

   • ASearch only by the email address 'alex.johnson@company.com'.
   • BPerform a wildcard search using 'alex*' or 'johnson*' to capture variations.
   • CSearch by the full name 'Alex Johnson' in the username field.
   • DSearch by the domain only and manually review all users.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A Falcon administrator is looking for a user account that was recently disabled. The administrator knows the user's username is 'asmith' but is not sure of the domain. What is the most efficient way to find this account in User Search?

   • ASearch by domain 'unknown' and username 'asmith'.
   • BSearch by the full name 'A Smith'.
   • CSearch by email 'asmith@unknown.com'.
   • DSearch by username 'asmith' and review the results for the disabled status.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security analyst has completed a User Search for a suspected compromised account and needs to share the findings with the incident response team, which uses a separate SIEM platform. The analyst wants to provide the raw data so the team can perform their own correlation. What is the most appropriate action?

   • ACopy and paste the results into a chat message.
   • BExport the User Search results to a CSV file and share it with the team.
   • CTake a screenshot of the User Search results and attach it to an email.
   • DVerbally summarize the findings in a meeting.
   Reveal Solution Discussion Select an answer first
5. 19expert · medium

   An analyst is investigating a user 'srodriguez' who is suspected of data exfiltration. The User Search results show that the user has logged into multiple devices in different geographical locations within a short time frame, and has accessed sensitive files. The analyst needs to provide evidence to the legal team. What is the best course of action?

   • AConfront the user directly about the activity.
   • BShare the raw CSV with the legal team without any analysis.
   • CImmediately disable the user's account and all associated devices.
   • DExport the User Search results and create a timeline of the user's activity.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An analyst is investigating a potential insider threat and wants to find all users who have the email domain 'external-partner.com' and are also members of the 'Contractors' group. Which search parameters should be used?

   • AEmail domain: external-partner.com, Group: Contractors
   • BUsername: external-partner, Group: Contractors
   • CDomain: external-partner.com, Title: Contractor
   • DEmail: @external-partner.com, Department: Contractors
   Reveal Solution Discussion Select an answer first