Perform an Event Advanced Search from a Detection and Refine a Search Using Event Actions CCFR Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   An analyst wants to focus on events that share a specific field value seen in one interesting event. Which event action would add that value as a filter to the current search?

   • AAdd to Search
   • BRemove
   • CCopy
   • DExclude
   Reveal Solution Discussion Select an answer first
2. 12application · easy

   An analyst is investigating a detection and has pivoted to an Event Advanced Search. The analyst wants to see events from the last 30 minutes, but the current search is showing events from the last 24 hours. Which action should the analyst take to refine the search?

   • AAdd a filter for the event type 'ProcessRollup2'.
   • BSort the results by timestamp and manually ignore events older than 30 minutes.
   • CAdjust the search time range to 'Last 30 minutes'.
   • DUse the 'Exclude' action on events older than 30 minutes.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A responder is analyzing Event Advanced Search results and notices that the events are not what they expected. The detection was for a file write, but the search results show process creation events. What is the most likely reason for this discrepancy, and what should the responder do?

   • AThe search time range is too narrow; the responder should expand it to see the file write events.
   • BThe search is showing all events on the host; the responder should exclude the process creation events.
   • CThe detection was incorrect; the responder should ignore the search results.
   • DThe search was not filtered to the correct event type; the responder should add a filter for the file write event type.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   While reviewing Event Search results, an analyst identifies a field value that is causing noise and wants to remove all events with that value from the results. Which event action should the analyst use?

   • APivot
   • BHighlight
   • CAdd to Search
   • DExclude
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   An analyst is investigating a detection and has pivoted to an Event Advanced Search. The initial results show a large number of events, and the analyst suspects that a specific benign process is generating noise. The analyst wants to remove the benign process events but is concerned that the process name alone might also match a malicious process with a similar name. What is the best approach to avoid this risk?

   • AAdd a filter for the benign process name and then use 'Exclude' on the filtered results.
   • BManually add a negative filter for the process name in the query.
   • CUse 'Exclude' on a representative event from the benign process, then review the results to ensure no malicious events were removed.
   • DIgnore the benign process events and manually review the remaining events.
   Reveal Solution Discussion Select an answer first