When reviewing a Host Timeline, which of the following filters is available?
ASeverity
BEvent Types
CUser Name
DDetection ID
From a detection, what is the fastest way to see children and sibling process information?
ASelect the Event Search option. Then from the Event Actions, select Show Associated Event Data (From TargetProcessId_decimal)
BSelect Full Detection Details from the detection
CRight-click the process and select "Follow Process Chain"
DSelect the Process Timeline feature, enter the AID, Target Process ID, and Parent Process ID
Which of the following is NOT a filter available on the Detections page?
ASeverity
BCrowdScore
CTime
DTriggering File
What are Event Actions?
AAutomated searches that can be used to pivot between related events and searches
BPivotable hyperlinks available in a Host Search
CCustom event data queries bookmarked by the currently signed in Falcon user
DRaw Falcon event data
Which is TRUE regarding a file released from quarantine?
ANo executions are allowed for 14 days after release
BIt is allowed to execute on all hosts
CIt is deleted
DIt will not generate future machine learning detections on the associated host
Where can you find hosts that are in Reduced Functionality Mode?
AEvent Search
BExecutive Summary dashboard
CHost Search
DInstallation Tokens
How does a DNSRequest event link to its responsible process?
AVia both its ContextProcessId_decimal and ParentProcessId_decimal fields
BVia its ParentProcessId_decimal field
CVia its ContextProcessId_decimal field
DVia its TargetProcessId_decimal field
What is an advantage of using a Process Timeline?
AProcess related events can be filtered to display specific event types
BSuspicious processes are color-coded based on their frequency and legitimacy over time
CProcesses responsible for spikes in CPU performance are displayed over time
DA visual representation of Parent-Child and Sibling process relationships is provided
The Bulk Domain Search tool contains Domain information along with which of the following?
AProcess Information
BPort Information
CIP Lookup Information
DThreat Actor Information
Where are quarantined files stored on Windows hosts?
AWindows\Quarantine
BWindows\System32\Drivers\CrowdStrike\Quarantine
CWindows\System32\
DWindows\temp\Drivers\CrowdStrike\Quarantine
After running an Event Search, you can select many Event Actions depending on your results. Which of the following is NOT an option for any Event Action?
ADraw Process Explorer
BShow a +/- 10-minute window of events
CShow a Process Timeline for the responsible process
DShow Associated Event Data (from TargetProcessId_decimal or ContextProcessId decimal)
You found a list of SHA256 hashes in an intelligence report and search for them using the Hash Execution Search. What can be determined from the results?
AIdentifies a detailed list of all process executions for the specified hashes
BIdentifies hosts that loaded or executed the specified hashes
CIdentifies users associated with the specified hashes
DIdentifies detections related to the specified hashes
The function of Machine Learning Exclusions is to _____________.
Astop all detections for a specific pattern ID
Bstop all sensor data collection for the matching path(s)
Cstop all Machine Learning Preventions but a detection will still be generated and files will still be uploaded to the CrowdStrike Cloud
Dstop all ML-based detections and preventions for the matching path(s) and/or stop files from being uploaded to the CrowdStrike Cloud
What information does the MITRE ATT&CK Framework provide?
AIt provides best practices for different cybersecurity domains, such as Identify and Access Management
BIt provides a step-by-step cyber incident response strategy
CIt provides the phases of an adversary's lifecycle, the platforms they are known to attack, and the specific methods they use
DIt is a system that attributes attack techniques to a specific threat actor
Within the MITRE-Based Falcon Detections Framework, what is the correct way to interpret Keep Access > Persistence > Create Account?
AAn adversary is trying to keep access through persistence by creating an account
BAn adversary is trying to keep access through persistence using browser extensions
CAn adversary is trying to keep access through persistence using external remote services
DAn adversary is trying to keep access through persistence using application skimming
When you configure and apply an IOA exclusion, what impact does it have on the host and what you see in the console?
AThe process specified is not sent to the Falcon Sandbox for analysis
BThe associated detection will be suppressed and the associated process would have been allowed to run
CThe sensor will stop sending events from the process specified in the regex pattern
DThe associated IOA will still generate a detection but the associated process would have been allowed to run
How long does detection data remain in the CrowdStrike Cloud before purging begins?
A90 Days
B45 Days
C30 Days
D14 Days
What action is used when you want to save a prevention hash for later use?
AAlways Block
BNever Block
CAlways Allow
DNo Action
You receive an email from a third-party vendor that one of their services is compromised, the vendor names a specific IP address that the compromised service was using. Where would you input this indicator to find any activity related to this IP address?
AIP Addresses
BRemote or Network Logon Activity
CRemote Access Graph
DHash Executions
In the Hash Search tool, which of the following is listed under Process Executions?
AOperating System
BFile Signature
CCommand Line
DSensor Version
What is the difference between a Host Search and a Host Timeline?
AResults from a Host Search return information in an organized view by type, while a Host Timeline returns a view of all events recorded by the sensor
BA Host Timeline only includes process execution events and user account activity
CResults from a Host Timeline include process executions and related events organized by data type. A Host Search returns a temporal view of all events for the given host
DThere is no difference - Host Search and Host Timeline are different names for the same search page
What is the difference between Managed and Unmanaged Neighbors in the Falcon console?
AA managed neighbor is currently network contained and an unmanaged neighbor is uncontained
BA managed neighbor has an installed and provisioned sensor
CAn unmanaged neighbor is in a segmented area of the network
DA managed sensor has an active prevention policy
What is an advantage of using the IP Search tool?
AIP searches provide manufacture and timezone data that can not be accessed anywhere else
BIP searches allow for multiple comma separated IPv6 addresses as input
CIP searches offer shortcuts to launch response actions and network containment on target hosts
DIP searches provide host, process, and organizational unit data without the need to write a query
What happens when you open the full detection details?
AThe process explorer opens and the detection is removed from the console
BThe process explorer opens and you’re able to view the processes and process relationships
CThe process explorer opens and the detection copies to the clipboard
DThe process explorer opens and the Event Search query is run for the detection
Preview
