Explain What Information a Hosts Timeline Will Provide CCFR Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A Falcon analyst is investigating a potential ransomware infection on a Windows host. The Hosts Timeline shows a large number of file write events to user directories, followed by a process execution that matches a known ransomware signature. The analyst needs to establish the timeline of compromise. What should the analyst do?

   • AExport the timeline to a PDF and share it with the incident response team.
   • BReview the timeline chronologically, noting the first file write event and the subsequent process execution.
   • CFilter the timeline to show only the ransomware process execution event.
   • DSearch the timeline for the ransomware signature and review only those events.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   When viewing an individual event in the Hosts Timeline, what information is typically available?

   • AThe full packet capture of the network traffic
   • BThe complete disk image of the host at the time of the event
   • CThe timestamp, associated process, user, and relevant metadata
   • DThe list of all other hosts that saw the same event
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following criteria can be used to filter the Hosts Timeline?

   • AThe name of the analyst who created the host record
   • BThe physical location of the host's data center
   • CEvent type, such as process execution or network connection
   • DThe version of the Falcon sensor installed
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the primary value of correlating multiple events on the Hosts Timeline?

   • ATo calculate the total number of events per day
   • BTo reconstruct a sequence of actions or a potential attack chain
   • CTo determine the exact version of the Falcon sensor
   • DTo verify that the host is online
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An incident responder is analyzing a Hosts Timeline for a compromised Linux host. The timeline shows a series of events: a user logs in via SSH, then a process is executed, then a file is written to /tmp, and then a network connection is made to an external IP. The responder needs to determine if the file write and network connection are related to the SSH login. What is the best approach?

   • ACorrelate the timestamps and user accounts across the events to see if they form a logical sequence.
   • BExport the timeline to a CSV and analyze the events in a spreadsheet.
   • CFilter the timeline to show only network connections and ignore the other events.
   • DSearch the timeline for the external IP and review only those events.
   Reveal Solution Discussion Select an answer first