Determine Response Actions CCFR Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   An analyst is investigating a detection that involves a domain that is not in any internal logs. The domain has low external prevalence, but the analyst wants to determine if it is malicious. The analyst has limited time and needs to make a quick decision. What is the best use of Falcon's built-in OSINT tools?

   • AUse Falcon Intelligence to conduct a full threat research
   • BUse Falcon's built-in OSINT lookup to check the domain's reputation
   • CUse event search to find internal connections to the domain
   • DUse Falcon Sandbox to detonate a file associated with the domain
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   A file hash is found on many hosts across the customer's environment, but it is not reported in any external threat intelligence sources. What is the most appropriate response consideration?

   • ALack of external prevalence means the file is definitely safe
   • BHigh internal prevalence increases the potential impact, so the file should be investigated even if external sources do not flag it
   • CHigh internal prevalence means the file should be immediately blocked without investigation
   • DHigh internal prevalence indicates the file is likely benign, so no action is needed
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A detection is triggered for a file that is present on 80% of the organization's hosts. External prevalence is high, and the file is signed by a reputable vendor. The file is flagged by ML as suspicious. What is the best response action?

   • AInvestigate the file's behavior and reputation before deciding
   • BBlock the file hash
   • CAllowlist the file hash
   • DQuarantine the file on all hosts
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company has a critical application that is being flagged by ML. The application is signed by a reputable vendor and is used by all employees. The analyst wants to ensure the application runs without generating detections, but also wants to maintain visibility if the application is used maliciously. What is the best approach?

   • AAllowlist the application's hash
   • BCreate an ML exclusion rule for the application
   • CTake no action
   • DBlock the application
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is a recommended remediation step after confirming a quarantined file is malicious?

   • ALeave the file quarantined indefinitely without action
   • BDelete the file and ensure the host is clean
   • CAdd the file to the allowlist to prevent future quarantines
   • DRestore the file to its original location
   Reveal Solution Discussion Select an answer first