CCFH-202B: CrowdStrike Certified Falcon Hunter

By CrowdStrike · Question Mode

QuestionQ22

VerifiedHunting Methodology

A ransomware infection has spread across the enterprise.

What first action would you take to identify the source of the infection?

Explanation

The earliest encryption event identifies the first known affected system, providing the starting point for tracing preceding activity and determining the infection source. A timeline of encryption activity in Advanced Event Search is therefore the appropriate initial investigation step.

Community Discussion

No comments yet. Be the first to start the discussion!