Analyze the Information Provided in Host Search Results CCFR Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   A Falcon Responder is reviewing Host Search results and needs to quickly determine which hosts have not communicated with the CrowdStrike cloud recently. Which field in the Host Search results should be used to make this determination?

   • ALast seen
   • BAgent version
   • COS
   • DHostname
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A Falcon investigator is looking at Host Search results and sees a host with an 'OS' of 'Windows 10 Pro' and an 'Agent Version' of '6.44.15806.0'. The investigator knows that the latest agent version is '7.x' and is concerned about the host's security posture. What is the most immediate risk associated with this host?

   • AThe host is not protected by Falcon because the agent version is too old.
   • BThe host's operating system is no longer supported by Microsoft, making it vulnerable.
   • CThe host may be missing critical security updates and features that are available in newer agent versions.
   • DThe host is likely infected with malware because it is running an outdated agent version.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An administrator is troubleshooting an issue where a specific host, 'FIN-PAY-APP', is not appearing in Host Search results. The administrator knows the host is powered on and has network connectivity. What is the most likely reason for the host not appearing in Host Search?

   • AThe host is offline and has not checked in with the Falcon cloud recently.
   • BThe host is in a 'Quarantined' state and is hidden from Host Search by default.
   • CThe Falcon sensor on the host is not installed or is not running properly.
   • DThe administrator does not have the correct permissions to view the host.
   Reveal Solution Discussion Select an answer first
5. 14application · easy

   A Falcon administrator is reviewing Host Search results and sees a host with the hostname 'WEB-PROD-01' and an 'OS' of 'Linux'. The administrator needs to know if this host is currently active. Which field in the Host Search results should the administrator examine to make this determination?

   • AThe 'OS' field, to see if the operating system is currently supported.
   • BThe 'Agent Version' field, to see if the sensor is up-to-date.
   • CThe 'Hostname' field, to see if it follows a naming convention that implies activity.
   • DThe 'Status' field, to see if it is marked as 'Online' or 'Offline'.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An investigator is analyzing a detection on a host named 'SRV-DB-01'. The Host Search results show this host has an 'Agent Version' of '7.10.12345.0' and a 'Last Seen' timestamp from 5 minutes ago. The investigator wants to confirm if this host is the same system that was involved in a previous incident last month. What is the most reliable way to correlate this host with the previous incident?

   • AUse the 'Last Seen' timestamp to verify the host was active during the time of the previous incident.
   • BUse the hostname 'SRV-DB-01' to search for all detections associated with that name in the past month.
   • CUse the unique 'Agent ID' (AID) associated with the host to search for detections from the previous incident.
   • DUse the 'Agent Version' to check if the host has been updated since the last incident.
   Reveal Solution Discussion Select an answer first