Explain What Information a Hosts Timeline Will Provide CCFR Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security analyst is new to Falcon and wants to understand what the Hosts Timeline provides for a specific endpoint. The analyst needs a comprehensive view of all host-centric activity to begin an investigation. What should the analyst expect to see in the Hosts Timeline?

   • AA chronological list of events such as process executions, network connections, file writes, and authentication activities for that host.
   • BA graph of network connections between the host and other systems, showing only external IP addresses.
   • CA list of all alerts generated by Falcon for that host, including detection and prevention alerts.
   • DA summary of the host's configuration, including installed software and system settings.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A Falcon analyst is investigating a suspected insider threat on a Windows host. The Hosts Timeline shows a series of authentication events using a service account, followed by a process execution that accesses a sensitive file share. The analyst needs to determine if the service account was compromised or if the activity is legitimate. The analyst has access to the Hosts Timeline for the host and the authentication logs. What is the most effective approach?

   • ASearch the timeline for the sensitive file share name and review only those events.
   • BCorrelate the authentication events with the process execution, checking if the timestamps and source IPs align with known legitimate activity.
   • CFilter the timeline to show only authentication events and ignore process executions.
   • DExport the authentication events to a separate report and analyze them independently.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   In CrowdStrike Falcon, what is the primary purpose of the Hosts Timeline?

   • ATo provide a network-wide summary of all alerts generated across the entire organization
   • BTo display a chronological, host-centric view of security events collected from a single endpoint
   • CTo list all configuration changes made by administrators to the Falcon sensor
   • DTo show a real-time stream of raw network packets captured from the host's interface
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   An incident responder is investigating a potential data exfiltration on a Windows host. The Hosts Timeline shows a large number of file read events from a sensitive directory, followed by a network connection to an external IP. The responder needs to determine if the file reads are related to the network connection. The responder has access to the Hosts Timeline and the firewall logs. What is the most effective approach?

   • AFilter the timeline to show only network connections and ignore file read events.
   • BExport the file read events to a separate report and analyze them independently.
   • CCorrelate the file read events with the network connection, checking if the timestamps and user accounts align.
   • DSearch the timeline for the external IP and review only those events.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   During an incident investigation, an analyst uses the Hosts Timeline to determine when a suspicious file was first written to the host. What is this an example of?

   • AConfiguring a new detection rule
   • BPerforming a vulnerability scan
   • CDeleting the malicious file
   • DEstablishing a timeline of compromise
   Reveal Solution Discussion Select an answer first