Distinguish Between Commonly Used Event Types CCFR Practice Questions (Page 4)

Questions 16–19

1. 16application · medium

   A Falcon administrator is investigating a suspected data exfiltration incident. The threat actor is believed to have used a legitimate system tool to transfer data to an external IP address over HTTPS. Which event type should the administrator query in Falcon Event Search to confirm the outbound connection?

   • ADnsRequest
   • BNetworkConnectIP4
   • CProcessRollup2
   • DFileWritten
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A Falcon administrator is investigating a data breach where an attacker exfiltrated data via a legitimate cloud storage service. The administrator has identified the process that performed the exfiltration but needs to determine the exact files that were uploaded. The attacker used a custom script that read files and then uploaded them via HTTPS. Which event type should the administrator query to identify the files that were read by the script?

   • ANetworkConnectIP4
   • BProcessRollup2
   • CFileWritten
   • DFileRead
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which event type would you use to investigate a suspicious file modification on an endpoint?

   • ANetworkConnectIP4
   • BFileWritten
   • CUserIdentityLogon
   • DProcessRollup2
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A Falcon administrator is investigating a privilege escalation attack where an attacker exploited a vulnerability to gain SYSTEM privileges. The administrator needs to identify the process that escalated privileges and the subsequent actions it performed. Which event types should be combined in the search to capture both the privilege escalation and the subsequent actions?

   • AProcessRollup2 and NetworkConnectIP4
   • BUserIdentityLogon and FileWritten
   • CDnsRequest and ProcessRollup2
   • DNetworkConnectIP4 and FileWritten
   Reveal Solution Discussion Select an answer first