CCFH-202B: CrowdStrike Certified Falcon Hunter

By CrowdStrike · Question Mode

QuestionQ9

VerifiedHunting Methodology

A ransomware infection has spread across the enterprise.

What would be the first action you take to determine the infection source?

Explanation

Endpoint investigation telemetry can be used to identify patient zero and trace the earliest initial-infection activity, establishing the technical source and propagation path of a ransomware incident.

Community Discussion

No comments yet. Be the first to start the discussion!