Analyze the Information Provided in Host Search Results CCFR Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   During an incident response, a Falcon administrator sees a host in Host Search with a status of 'Quarantined'. The administrator needs to understand what this status means for the investigation. Which statement accurately describes the 'Quarantined' status?

   • AThe host is online but has been isolated from the network by a Falcon policy or manual action.
   • BThe host is offline and has not communicated with the Falcon cloud for an extended period.
   • CThe host is a virtual machine that has been paused or suspended by the hypervisor.
   • DThe host has been detected as compromised and is actively being blocked from executing any processes.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   A Falcon Responder wants to narrow Host Search results to only show hosts running a specific operating system. Which Host Search feature should be used to achieve this?

   • ASorting by last seen
   • BFiltering by hostname
   • CSorting by hostname
   • DFiltering by OS
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   During an investigation, a Falcon Responder notes that a host in Host Search results has a 'Quarantined' status. How should this information be used in correlation with other data?

   • AIt confirms the host is compromised and requires immediate reimaging
   • BIt indicates the host is safe and can be ignored
   • CIt means the host is offline and not relevant
   • DIt suggests the host may have been involved in malicious activity and should be examined in related detections
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security team is preparing for a company-wide audit and needs to generate a report of all hosts that are currently online and have the Falcon sensor installed. The team wants to ensure the report is accurate and up-to-date. What is the most effective way to generate this list using Host Search?

   • AFilter by 'Last Seen: Today' and then export the results.
   • BSort by 'Status' and manually select all hosts with a green checkmark.
   • CFilter by 'Status: Online' and 'Sensor Present: True' and then export the results.
   • DFilter by 'OS: Windows' and then export the results.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   A Falcon Responder is investigating a detection and wants to see if the affected host has been seen in other contexts, such as in event data or as part of a larger pattern. Which approach best uses Host Search results to support this correlation?

   • AUse the hostname from Host Search to search other data sources like Event Search or Detection details
   • BUse the last seen field to determine if the host is infected
   • CUse the agent version to determine if the host is compromised
   • DUse the OS field to determine if the host is vulnerable
   Reveal Solution Discussion Select an answer first