Determine Response Actions CCFR Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   During an investigation, an analyst finds an IP address in a detection that is not in any internal logs. The analyst wants to quickly determine if this IP is known for malicious activity. Which built-in Falcon OSINT tool should the analyst use?

   • AFalcon Sandbox
   • BFalcon Intelligence
   • CFalcon's built-in OSINT lookup (e.g., in the detection details)
   • DFalcon X
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the effect of a sensor visibility exclusion in Falcon?

   • AIt suppresses all detections for the specified path
   • BIt prevents the sensor from collecting telemetry from a specified path or process
   • CIt allows the sensor to collect more data from the specified path
   • DIt blocks the execution of files in the specified path
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A detection is generated by an IOE (Indicator of Endpoint) rule that flags a suspicious file creation in a temp directory. The file is not seen elsewhere in the environment. What is the most appropriate response action?

   • AInvestigate the file's origin and behavior before deciding
   • BBlock the file hash
   • CQuarantine the file
   • DAdd the file to the allowlist
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   An analyst is investigating a suspicious domain and wants to see if it has been associated with any known malware campaigns. Which Falcon built-in OSINT tool should be used for this enrichment?

   • AFalcon OverWatch
   • BFalcon X
   • CFalcon Spotlight
   • DFalcon Device Control
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is an Indicator of Compromise (IOC) in the context of Falcon?

   • AA piece of forensic data that suggests a system may have been compromised
   • BA report generated by Falcon OverWatch
   • CA type of machine learning model used for detection
   • DA rule that automatically blocks all suspicious files
   Reveal Solution Discussion Select an answer first