Manage Endpoint Context CCFR Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A user reports that their workstation is behaving erratically, and you suspect malware. In Host Search, you pull up the workstation's details and see the Neighbors tab. The list shows 5 neighbors: 3 have the 'Managed by Falcon' badge, and 2 do not. You want to quickly check whether the suspected malware has already spread to the other managed workstations on the same subnet. What is the most efficient next step?

   • AClick on each managed neighbor's hostname to open its Host Search details and review its recent detection events.
   • BInitiate a Falcon Real Time Response (RTR) session against the unmanaged neighbors to collect forensic data.
   • CUse the unmanaged neighbors' IP addresses to SSH into them and check for signs of compromise.
   • DCreate a Falcon Prevention Policy that blocks the malware's hash on all managed neighbors automatically.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   You are responding to an incident where a managed workstation was used to scan the internal network. In Host Search, you view the workstation's Neighbors tab and see 15 hosts on the same subnet. You need to understand the potential blast radius of the scanning activity. Which information from the Neighbors tab is most useful for this assessment?

   • AThe list of hosts that are running the same operating system as the compromised workstation.
   • BThe list of hosts that have been flagged with detections in the past 24 hours.
   • CThe list of all hosts on the same subnet, along with their managed or unmanaged status.
   • DThe list of hosts that have communicated with the compromised workstation.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   You are investigating a managed host that was compromised. In Host Search, the Neighbors tab shows 5 hosts on the same subnet. You need to determine which neighbors are managed so you can use Falcon to check them for the same malware. Which UI element in the Neighbors tab indicates that a neighbor is managed?

   • AA 'Managed by Falcon' badge and the Falcon sensor version displayed next to the hostname.
   • BA green dot next to the hostname indicating the host is online.
   • CThe hostname is displayed in bold text.
   • DThe IP address is displayed in blue.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A Falcon analyst is reviewing the Host Search results for a compromised endpoint. The neighbor list shows one device with no sensor version and no Falcon agent details. How should the analyst classify this neighboring device?

   • AManaged, because it has an IP address
   • BManaged, because it appears in the neighbor list
   • CUnmanaged, because it lacks sensor version and agent details
   • DUnmanaged, because it is not in the same subnet
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   You are investigating a malware infection on a managed file server. In Host Search, the Neighbors tab shows 8 hosts on the same subnet. You need to determine which neighbors are managed so you can use Falcon to check them for the same malware. Which action should you take to see the managed status of each neighbor?

   • AUse Falcon's Network Connections feature to see which neighbors have active connections.
   • BClick on each neighbor's IP address to open a separate browser tab and check its status.
   • CLook for the 'Managed by Falcon' badge and sensor version next to each neighbor's hostname.
   • DRun a Falcon Real Time Response (RTR) command to list all managed hosts on the subnet.
   Reveal Solution Discussion Select an answer first