Explain What Information a Hosts Timeline Will Provide CCFR Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A Falcon analyst is reviewing a Hosts Timeline for a macOS endpoint. The analyst sees an event that shows a process named 'curl' making a network connection to an external IP address. The analyst needs to determine the command-line arguments used to invoke 'curl'. Which field in the event details should the analyst examine?

   • AThe 'Network Connection' field, which shows the destination IP and port.
   • BThe 'Command Line' field, which contains the full command-line string used to launch the process.
   • CThe 'Parent Process' field, which shows the process that launched 'curl'.
   • DThe 'File Hash' field, which identifies the executable file's hash.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following best describes the scope of data shown in a Hosts Timeline?

   • AEvents from all hosts in the same Active Directory domain
   • BEvents from a single host, including process, network, file, and authentication activity
   • COnly events that triggered a detection or alert on the host
   • DOnly events related to malware infections on the host
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A Falcon analyst is reviewing a Hosts Timeline for a Windows host and sees a network connection event. The event details show a source IP, destination IP, source port, and destination port. The analyst wants to know which process initiated the connection. Which field should the analyst examine?

   • AThe 'Source Port' field, which shows the local port used for the connection.
   • BThe 'Timestamp' field, which shows when the connection was made.
   • CThe 'Process' field, which shows the process that initiated the network connection.
   • DThe 'Destination IP' field, which shows the remote address.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   An investigator wants to see only process execution events from the last 24 hours on a specific host. What is the most direct way to accomplish this in the Hosts Timeline?

   • ACreate a new detection rule to generate a custom report
   • BApply a time range filter and an event type filter for process executions
   • CExport the entire timeline to CSV and manually sort the data
   • DNavigate to the host's 'Processes' tab and scroll through the list
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A Falcon analyst is investigating a suspected privilege escalation on a Linux host. The Hosts Timeline shows a series of authentication events followed by a process execution that runs with elevated privileges. The analyst wants to determine if the authentication events are related to the process execution. What should the analyst do?

   • ACorrelate the timestamps and user accounts of the authentication events with the process execution event.
   • BSearch the timeline for the process name and review only those events.
   • CFilter the timeline to show only process execution events and ignore authentication events.
   • DExport the authentication events to a separate report and analyze them independently.
   Reveal Solution Discussion Select an answer first