CCFH-202BPreview

You are investigating an alert for a process that connected to the following suspicious domain: reallysuspiciousdomain[.]com
Which of the Investigate dashboards would provide a list of processes that looked up the specified domain?

You want to use result data from an Advanced Event Search to create a custom dashboard that will display the total number of detections in a seven-day time period.
Which widget will allow you to display the total number of detections as buckets on a timeline?

During an investigation, you discover a Falcon host connecting from a country outside of those you normally do business with.
Which built-in report would display Falcon hosts connecting from that country?

Which CQL function is recommended to use when exporting a few fields from a large number of events (>100,000) to a CSV?

You suspect that a user is abusing their admin privileges and you want to see the recent commands they have been utilizing.
Which Investigate search will identify this?

You want to use result data from an Advanced Event Search to create a custom dashboard that will display the total number of detections in a seven-day time period.
Which widget will allow you to display the total number of detections as a single value digit?

Your organization has identified a malicious Scheduled task that executes every 5 minutes.
Which LogScale event search function can be used to quickly identify and display the unique hosts affected by the malware?

Which field in an event would show you whether a file was downloaded from a restricted site?

While reviewing network activity, you notice an increase in DNS requests for a newly registered domain with a poor reputation.
What is an appropriate first step to examine this potential threat?

Which action helps identify an enterprise-wide file infection?

Falcon Machine Learning has prevented and quarantined a file being written to disk that has VSCode as a parent process. This file was compiled by the system owner.
What should the next steps be?

You are investigating detections around network reconnaissance activity including multiple commands executed by cmd.exe and need to identify the root cause.
How can you quickly verify if these commands are the result of an exploited vulnerability?

Which pre-defined reports will show activities that typically indicate suspicious activity occurring on a system?

What is an appropriate use for the join() function within a query?

While performing triage on a detection, you notice an event with the name SyntheticProcessRollup2.
What conclusion can be made about this event?

What can a hunter add at the end of a search string in Advanced Event Search to identify outliers when quantifying the results?

Falcon has detected and prevented credential dumping activity on a domain controller. There were no obvious credential dumping tools identified in the detection.
What is the next step in your investigation?

You receive an alert for the following process tree:
IIS/W3WP.exe -> Powershell.exe -> cmd.exe -> whoami.exe -> net1.exe
Which of the following describes what has occurred?

You've written a complex query within Advanced Event Search that is returning millions of events, making it difficult to threat hunt for particular file metadata.
Which option would decrease query time and remove values that are not of interest?

Your organization uses an internally developed application for operations. The application is triggering Indicators of Attack (IOA) detections for vulnerable driver usage on servers where Falcon was just installed. After reviewing the application, you determine that application behavior is expected.
What will reduce risk in the environment the most?

When investigating two related processes within Advanced Event Search, how does the ContextProcessId relate to the TargetProcessId?

Which document can reference any searchable event and its description?

Where can you find details about key data fields to use in an advanced search query?

Which function would you add to a groupBy() to show all the associated domain names that an executable communicated to in a single record?