Analyze the Information Provided in Host Search Results CCFR Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   An investigator is correlating data from a third-party vulnerability scanner with Falcon Host Search results. The scanner reports that host 'APP-DEV-05' is vulnerable to a critical CVE. However, the Host Search results show that 'APP-DEV-05' has a 'Last Seen' timestamp from 60 days ago. What is the most appropriate conclusion for the investigator to draw?

   • AThe host is definitely compromised, as the vulnerability scanner detected a critical CVE.
   • BThe host is likely decommissioned or offline, and the vulnerability may not be exploitable in its current state.
   • CThe host is not vulnerable because it has not been seen by Falcon in 60 days.
   • DThe host is vulnerable and should be patched immediately, as the vulnerability scanner is the authoritative source.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   A host in Host Search results shows a status of 'Offline'. What does this status indicate about the host?

   • AThe host has not communicated recently
   • BThe host is actively communicating with the cloud
   • CThe host is currently quarantined
   • DThe host has been deleted from the console
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In Host Search results, which field provides the version of the Falcon sensor installed on the host?

   • AOS
   • BLast seen
   • CHostname
   • DAgent version
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   A Falcon Responder wants to view the most recently active hosts at the top of the Host Search results. Which action should be taken?

   • ASort by hostname
   • BFilter by last seen
   • CFilter by OS
   • DSort by last seen
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   An incident responder is investigating a data exfiltration incident. The responder has identified a suspicious process on host 'FIN-SRV-02'. The Host Search results show 'FIN-SRV-02' has a 'Last Seen' timestamp of 2 hours ago and is in the 'Finance' group. The responder also has a list of network connections from a separate tool that shows a connection from 'FIN-SRV-02' to an external IP address at the time of the incident. What is the most important next step to confirm the host's involvement?

   • AVerify that 'FIN-SRV-02' is in the 'Finance' group, as this confirms it is a high-value target.
   • BUse the 'Agent ID' (AID) of 'FIN-SRV-02' to search for all detections and events associated with that specific host during the incident timeframe.
   • CCheck the 'Last Seen' timestamp to ensure the host is still online and can be investigated.
   • DCheck the 'Agent Version' of 'FIN-SRV-02' to ensure it is up-to-date and capable of detecting the exfiltration.
   Reveal Solution Discussion Select an answer first