Manage Endpoint Context CCFR Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   You are investigating a managed host that was compromised. In Host Search, the Neighbors tab shows 6 hosts on the same subnet. You need to understand why the Neighbors tab is useful for your investigation. Which statement best describes the value of the Neighbors tab?

   • AIt automatically contains all unmanaged hosts on the subnet to prevent lateral movement.
   • BIt shows which hosts on the same subnet are managed by Falcon, allowing you to immediately pivot to those hosts for further investigation.
   • CIt shows the vulnerability status of all hosts on the subnet, allowing you to prioritize patching.
   • DIt shows the complete command-line history of all hosts on the subnet, allowing you to trace the malware's execution.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   You are investigating a server that was compromised via an exploited web application. In Host Search, the Neighbors tab shows 10 hosts, 7 of which are managed and 3 unmanaged. You need to determine if any of the unmanaged neighbors were also compromised by the same attacker. What is the most effective way to gather evidence about the unmanaged neighbors?

   • AInitiate a Falcon containment action on the unmanaged neighbors to prevent further spread.
   • BRun a Falcon Real Time Response (RTR) script on the unmanaged neighbors to collect forensic data.
   • CQuery Falcon's Event Search for detections on the unmanaged neighbors' IP addresses.
   • DUse Falcon's Network Connections data from the compromised server to identify communication with the unmanaged neighbors.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   During a threat hunt, you identify a suspicious PowerShell command executed on a server. In Host Search, you view the server's Neighbors tab and notice that one of the neighbors is an unmanaged legacy application server. You need to determine whether this legacy server communicated with the compromised server during the relevant time window. What is the best approach given the neighbor context?

   • AOpen a Real Time Response (RTR) session on the legacy server to check its network connections.
   • BQuery Falcon's Event Search for process execution data from the legacy server.
   • CCheck the legacy server's firewall logs through Falcon's Firewall Management feature.
   • DUse Falcon's Network Connections data for the compromised server to see if it connected to the legacy server's IP address.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   You are investigating a workstation that was used to access a malicious phishing link. In Host Search, the Neighbors tab shows 6 hosts on the same subnet. You notice that 4 are managed and 2 are unmanaged. You want to understand the network topology and identify which hosts are in the same broadcast domain. What does the Neighbors tab in Host Search actually represent?

   • AHosts that share the same Active Directory domain as the target host.
   • BHosts that are on the same subnet as the target host, as determined by the target's network configuration.
   • CHosts that have the same Falcon sensor version as the target host.
   • DHosts that have been observed communicating with the target host over the network.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Why is neighbor context in Host Search valuable for endpoint analysis during an investigation?

   • AIt identifies the physical location of the endpoint
   • BIt shows the endpoint's patch level and vulnerability status
   • CIt helps the analyst understand the host's network communication and potential lateral movement paths
   • DIt reveals which users are logged into the endpoint
   Reveal Solution Discussion Select an answer first