Determine Response Actions CCFR Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A file has been quarantined by Falcon. The analyst has verified that the file is benign and was a false positive. What is the best practice for handling this quarantined file?

   • ADelete the file from quarantine
   • BLeave the file in quarantine
   • CAdd the file to the blocklist
   • DRestore the file to its original location
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   A security team wants to monitor for a suspicious file without preventing its execution, to observe its behavior in a controlled environment. Which hash management action should be used?

   • ADetect Only
   • BAllow
   • CBlock
   • DNo action
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company has a legitimate application that is being flagged by ML. The analyst wants to ensure the application runs without generating detections, but also wants to maintain visibility if the application is used maliciously. What is the best approach?

   • ACreate an ML exclusion rule for the application
   • BBlock the application
   • CAllowlist the application's hash
   • DTake no action
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the effect of a machine learning exclusion rule in Falcon?

   • AIt hides the file from all detections, including IOA and IOE
   • BIt prevents the ML engine from flagging a specific file or path as malicious
   • CIt blocks all files that match the exclusion pattern
   • DIt allows the file to execute but still generates ML detections
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   After a file is quarantined by Falcon, what is the first step an analyst should take?

   • ADelete the file immediately to free up space
   • BRestore the file to its original location
   • CVerify the file is malicious before taking further action
   • DIgnore the quarantine because it is automatic
   Reveal Solution Discussion Select an answer first