Analyze the Information Provided in a User Search CCFR Practice Questions (Page 5)

Questions 21–24

1. 21expert · medium

   An analyst is investigating a user 'hlee' who has been flagged for unusual activity. The User Search results show that the user has logged in from a new device and has also changed their password twice in the past day. The analyst also notices that the user's email was used to reset a password for a different account. What is the most likely explanation?

   • AThe user's account is compromised, and the attacker is using the email to reset other accounts.
   • BThe user is testing a new password manager.
   • CThe user is a victim of a phishing attack and is trying to secure their accounts.
   • DThe user is simply updating their security settings.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is a valid search parameter in Falcon's User Search?

   • AHostname
   • BUsername
   • CFile hash
   • DIP address
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security analyst is investigating a phishing campaign that targeted users in the 'sales' department. The analyst wants to find all users whose email addresses end with '@company.com' and who are part of the 'sales' group. Which search parameters should be used?

   • AEmail: @company.com, Department: sales
   • BDomain: company.com, Title: sales
   • CUsername: sales, Email domain: company.com
   • DEmail domain: company.com, Group: sales
   Reveal Solution Discussion Select an answer first
5. 24expert · medium

   An analyst is reviewing User Search results for a user 'kpatel' and notices that the user's account has been locked out multiple times in the past hour. The analyst also sees that the user's last successful login was from an IP address in a different country than the user's normal location. What is the most likely scenario?

   • AThe user's device is infected with malware; the analyst should reimage the device.
   • BThe user is using a VPN; the analyst should whitelist the IP.
   • CThe user is traveling and forgot their password; no action is needed.
   • DThe account is under a brute-force attack, and the analyst should enable MFA and reset the password.
   Reveal Solution Discussion Select an answer first