Analyze the Information Provided in Host Search Results CCFR Practice Questions (Page 4)

Questions 16–18

1. 16application · medium

   A security analyst is looking for all hosts that are running a specific, outdated version of the Falcon sensor (6.43.x) to plan an upgrade. The analyst knows the company has thousands of hosts. What is the most efficient way to identify these hosts in Host Search?

   • AExport all hosts to a CSV file and use a script to parse the 'Agent Version' column.
   • BUse the global search bar to search for 'agent_version:6.43' and review the results.
   • CApply a filter to the 'Agent Version' field to show only hosts with a version starting with '6.43'.
   • DSort the results by 'Agent Version' and manually scroll through the list to find all hosts with version 6.43.x.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An investigator is reviewing a detection on host 'USR-JSMITH-LT'. The Host Search results show the host's 'Last Seen' timestamp is from 3 days ago. The investigator needs to determine if this host could have been involved in the current detection, which occurred 1 hour ago. What should the investigator conclude?

   • AThe host is likely the source of the detection, as the 'Last Seen' timestamp is not relevant to the investigation.
   • BThe host could be the source of the detection, as the 'Last Seen' timestamp may be inaccurate.
   • CThe host is definitely the source of the detection, as it is the only host with a matching username.
   • DThe host is unlikely to be the source of the detection, as the sensor has not been active in the last 3 days.
   Reveal Solution Discussion Select an answer first
3. 18expert · hard

   A Falcon administrator is managing a fleet of hosts and notices that a specific host, 'HR-SRV-01', has a status of 'Quarantined'. The administrator needs to determine why the host was quarantined and decide on the next steps. What is the most appropriate action for the administrator to take?

   • AReboot the host to clear the quarantine state, as this will resolve the issue.
   • BImmediately remove the quarantine to restore the host's network access, as it is likely a false positive.
   • CCheck the host's detections and event history to understand the reason for the quarantine before taking any action.
   • DIgnore the quarantine status, as it is a standard state for all hosts in the 'HR' group.
   Reveal Solution Discussion Select an answer first