Free CCFP practice test: 30 questions with answers

Encrypting files, renaming them, and leaving a note that demands payment are the defining behaviours of ransomware. Spyware and botnet agents aim to steal data or wait for commands, and adware only displays advertising, so none of them matches the encryption-for-payment pattern.

In ATT&CK, a tactic describes the attacker's goal at a given stage, such as Persistence or Discovery, and a technique describes how that goal is achieved. The other options confuse the framework with malware families, defensive controls, or platform labels.

Moving from host to host after an initial foothold, toward systems such as domain controllers, is the Lateral Movement tactic. Exfiltration, Collection, and Impact describe different goals: moving data out, gathering it, or disrupting systems.

Endpoint detection and response records detailed host telemetry and supports investigation and containment on the affected machine. An email gateway filters messages, a vulnerability scanner finds weaknesses, and a SIEM correlates logs centrally but is not the tool that records endpoint activity for containment.

Alert fatigue comes from noisy detections, so tuning them and ranking alerts by risk lets analysts focus on likely true positives. Longer retention does not reduce noise, disabling detections creates blind spots, and escalating everything only moves the overload to senior staff.

Generative AI lets attackers produce polished lures and research targets faster, which lowers the effort needed for social engineering. The other options are false because AI misuse is not reliably blocked, no model predicts every intrusion, and AI-written text often has no obvious errors.

A SIEM aggregates and correlates logs from many sources and gives analysts central search and retention for investigations. Real-time blocking is a prevention function of endpoint tools, and a SIEM does not replace endpoint telemetry or analyst review.

Impersonating an executive, using a lookalike domain, and pressuring the recipient to bypass approval are the hallmarks of business email compromise. Ransomware encrypts files, credential stuffing reuses leaked passwords, and a watering hole attack compromises a website, so none of them fits this payment fraud.

A lightweight, cloud-native sensor sends telemetry to a cloud platform for analysis, which keeps endpoint overhead low and avoids per-office detection infrastructure. The other options add local databases, on-premises servers, or permanent VPN dependencies that this design is meant to remove.

A single console reduces tool switching and lets analysts correlate data across domains in one place. Separate logins and queues recreate the fragmentation a unified platform removes, while dropping endpoint data or removing analysts from response are not benefits.

Falcon Prevent is the next-generation antivirus module that prevents malware and suspicious execution on endpoints. Next-Gen SIEM handles log ingestion and search, Identity Protection watches directory and authentication activity, and Exposure Management prioritizes asset exposure rather than blocking execution.

Falcon Insight XDR is the extended detection and response offering that correlates detections across endpoint, identity, and other data sources. Prevent focuses on blocking malware, Exposure Management on vulnerabilities, and Cloud Security on cloud configuration, so none of them is the cross-domain detection tool.

Enrichment adds context such as known indicators and adversary associations, which helps analysts decide how urgently to act. Enrichment does not guarantee a verdict, delete logs, or change sensor policy on its own.

Falcon Exposure Management discovers assets and prioritizes vulnerabilities and misconfigurations by how exposed they are to attack. The other modules focus on log search, identity activity, and endpoint prevention rather than exposure ranking.

Cloud-native sensors keep endpoint overhead low and avoid building on-premises detection servers, which speeds rollout. Guaranteed protection without any connectivity, removal of staff, and automatic confirmation of every alert are not benefits that such a design provides.

Falcon Identity Protection focuses on authentication and directory activity, including unusual account use that points to lateral movement. The other modules focus on log search, cloud configuration, and exposure ranking rather than identity behavior.

Prioritization should weigh severity and asset criticality, so the high-severity detection on a domain controller comes first. Age, hostname order, or assumed noise from a test system are not reliable reasons to set the order, and the test-laptop detection should still be checked.

Universal search lets analysts locate entities such as hosts, hashes, or users from one place without navigating each module. The other options describe policy management, audit export, and endpoint housekeeping, which are separate functions.

Bookmarks store a frequently used view so analysts can return to it quickly during routine triage. Update schedules, deletion of records, and automatic severity changes are not what bookmarks do, and the last two would also undermine the investigation.

A sound flow starts with the detection, pivots to related activity to define scope, and only then chooses containment and remediation. Closing alerts early misses related activity, while deleting the sensor or handing off without review destroys visibility or delays response.

The cycle is iterative: lessons from investigation and response improve detection logic. The other options break that loop by removing evidence review, disabling detection, or limiting investigation to cases with no alerts.

Narrowing the time range focuses the investigation on when the activity likely happened and reduces unrelated results. Filtering does not delete records, change sensor channels, or affect licensing.

Network isolation and stopping the active process limit damage and spread while the evidence remains available. Waiting for a scheduled scan lets encryption continue, and deleting event history destroys the evidence needed for scoping and root-cause analysis.

Charlotte AI is the generative AI assistant in the Falcon platform and can help analysts with natural-language questions and summaries. The other modules block malware, watch identity activity, or rank exposures, and none is an assistant for summarizing a detection.

Threat Graph correlates endpoint events into relationships, and machine learning can recognize attack patterns that no single event reveals. The other options describe network scanning, local storage, or a guarantee that no detection system can give.

Least-privilege scope, approval gates for high-impact actions, and audit logs keep agentic workflows safe and reviewable. Unlimited rights, no logging, or shared credentials remove the controls that make automation trustworthy.

AI output works best as a prioritization aid, while analysts validate the result against telemetry and make the final decision. Automatic closure, replacing source data, or skipping documentation removes the human check and the audit trail that triage depends on.

AI systems can be confidently wrong, so unchecked output can create false positives and missed threats. The other options assert claims that no system guarantees, including zero false negatives, automatic superiority over analysts, and no need for data governance.

Anomaly detection with machine learning helps defenders spot behavior that signature-based tools miss. The other examples show attackers using AI for impersonation or malware variants, or a data-handling risk rather than a defensive use.

Validating conclusions against source telemetry and restricting data to approved, governed sources are core safeguards. Accepting verdicts unreviewed or disabling audit logs removes the checks needed to catch errors and prove accountability.