Analyze the Information Provided in an IP Search CCFR Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   During an incident investigation, an analyst finds a suspicious IP in IP Search and wants to see if any hosts in the environment have executed files associated with that IP. Which Falcon data source should the analyst correlate with the IP Search results?

   • AEvent Search
   • BFalcon Spotlight
   • CFalcon Sandbox
   • DFalcon Discover
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An IP Search for 203.0.113.88 shows it is associated with a host that has a detection for a known malware family. The Responder wants to determine if the malware is still active on the host. Which Falcon data should the Responder correlate with the IP Search results?

   • AThe IP's geolocation
   • BThe host's recent network connections
   • CThe host's operating system version
   • DThe IP's WHOIS registration
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   When analyzing the reputation of an IP address in Falcon, what does a 'malicious' reputation indicate?

   • AThe IP address has been associated with known malicious activity
   • BThe IP address is owned by a known threat actor
   • CThe IP address is part of a botnet
   • DThe IP address is currently blocked by Falcon
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An IP Search for 203.0.113.150 returns a threat score of 10, but the IP is associated with a domain that has been flagged for phishing. The Responder must decide whether to include this IP in an IOC blocklist. What is the most appropriate action?

   • AAdd the IP to the blocklist because the domain is flagged for phishing.
   • BAdd the IP to the blocklist only if it is in the same subnet as other flagged IPs.
   • CDo not add the IP to the blocklist because the threat score is low.
   • DInvestigate the relationship between the IP and the phishing domain before deciding.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A Responder is investigating a potential data exfiltration incident. An IP Search for 203.0.113.55 shows a threat score of 70 and an association with a domain known for data theft. However, the IP is also used by a major cloud storage provider. The Responder must decide whether to block the IP. What is the most appropriate action?

   • ABlock the IP only if the threat score exceeds 90.
   • BDo not block the IP because it belongs to a legitimate provider.
   • CBlock the IP immediately to stop potential exfiltration.
   • DCorrelate the IP Search data with host network connections to confirm exfiltration before blocking.
   Reveal Solution Discussion Select an answer first