Determine Response Actions CCFR Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   A Falcon analyst sees a detection generated by an Indicator of Attack (IOA) rule that correlates unusual process behavior with a known adversary technique. Which response action is most appropriate for this type of detection?

   • AImmediately block the file hash associated with the process
   • BIgnore the detection because IOA detections are always false positives
   • CInvestigate the behavior and contain the affected host if malicious activity is confirmed
   • DAdd the process name to the allowlist to prevent future false positives
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security team is considering adding a known benign file to the allowlist to reduce noise. However, they are concerned that this might hide future malicious activity. What is the primary effect of allowlisting on detection and response?

   • AIt quarantines the file
   • BIt prevents the file from executing
   • CIt blocks the file from running
   • DIt suppresses detections for that file
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An analyst is investigating a detection that involves a process creating a scheduled task. The process is a legitimate system tool, but the behavior is suspicious. The analyst wants to reduce false positives without disabling detection for the behavior entirely. What is the best approach?

   • ACreate an ML exclusion rule
   • BCreate an IOA exclusion for the specific process
   • CAllowlist the process hash
   • DBlock the process
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the primary effect of adding an indicator to the allowlist in Falcon?

   • AIt permits the indicator and suppresses detections for it
   • BIt only suppresses detections but does not allow the activity
   • CIt has no effect on detection or response
   • DIt prevents the indicator from being detected and blocks any associated activity
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A file has been quarantined by Falcon. The analyst wants to verify that the file is indeed malicious before taking further action. What is the best practice for handling the quarantined file?

   • ARestore the file immediately to avoid disruption
   • BDelete the file from quarantine without analysis
   • CLeave the file in quarantine indefinitely
   • DAnalyze the file in a sandbox before deciding
   Reveal Solution Discussion Select an answer first