Manage Endpoint Context CCFR Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   You are investigating a managed host that was compromised. The Neighbors tab shows 12 hosts on the same subnet, 7 managed and 5 unmanaged. You need to understand the network topology to assess the blast radius of the compromise. You notice that the Neighbors tab includes hosts from different subnets. What does this indicate?

   • AThe hosts are on the same subnet as the target host, as determined by the target's IP address and subnet mask.
   • BThe hosts have communicated with the target host in the past 24 hours.
   • CThe hosts are running the same operating system as the target host.
   • DThe hosts are in the same Active Directory site as the target host.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   You are responding to an incident on a managed host. The Neighbors tab shows 4 managed and 4 unmanaged hosts on the same subnet. You have limited time and need to prioritize which neighbors to investigate for signs of lateral movement. Which factor should you weigh MOST heavily in your prioritization?

   • AUnmanaged hosts should be prioritized because they are more likely to be compromised due to lacking security controls.
   • BHosts with the oldest operating systems should be prioritized because they are more likely to be exploited.
   • CHosts with the highest IP addresses should be prioritized because they are likely newer and more valuable targets.
   • DManaged hosts should be prioritized because you can immediately query them via Falcon for detections and activity.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   You are investigating a malware outbreak that appears to have spread laterally from a compromised file server. In Host Search, you view the file server's details and expand the Neighbors tab. You see 12 neighboring endpoints listed, but only 4 show the 'Managed by Falcon' badge. Why is the neighbor information in Host Search valuable for your investigation, even for the 8 unmanaged neighbors?

   • AIt shows the full command-line history of the unmanaged neighbors, allowing you to trace the malware's execution path.
   • BIt automatically quarantines unmanaged neighbors to prevent further spread of the malware.
   • CIt identifies which unmanaged neighbors are running vulnerable software versions, so you can patch them immediately.
   • DIt provides a list of candidate hosts that may have been exposed to the same lateral movement, helping you scope the investigation and prioritize manual response actions.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   You are responding to an incident on a domain controller. In Host Search, the Neighbors tab shows a mix of managed and unmanaged hosts. You need to prioritize which neighbors to investigate first for signs of credential theft or lateral movement. Which factor should be your PRIMARY consideration when prioritizing?

   • AThe age of the neighbor's operating system, assuming older systems are more likely compromised.
   • BWhether the neighbor is managed by Falcon, because you can immediately query it for detections and activity.
   • CThe number of open ports on each neighbor, as shown in the Neighbors tab.
   • DThe alphabetical order of the hostnames, to ensure a systematic review.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   You are investigating a compromised managed server. The Neighbors tab shows 5 managed hosts and 3 unmanaged hosts on the same subnet. You have a strong suspicion that the attacker used the compromised server to pivot to one of the unmanaged hosts. You need to gather evidence of this lateral movement, but you have no direct access to the unmanaged hosts. Which approach will yield the most useful evidence?

   • AExamine the compromised server's Falcon Network Connections data for connections to the unmanaged hosts' IP addresses during the relevant time window.
   • BUse Falcon Real Time Response (RTR) to run a network connection query on the unmanaged hosts.
   • CInitiate a Falcon containment action on the unmanaged hosts to prevent further spread.
   • DCheck the Falcon Event Search for detections on the unmanaged hosts' IP addresses.
   Reveal Solution Discussion Select an answer first