Summer Sale Special - Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: sntaclus

examout.co

What do IOA exclusions help you achieve?

A.

Reduce false positives based on Next-Gen Antivirus settings in the Prevention Policy

B.

Reduce false positives of behavioral detections from IOA based detections only

C.

Reduce false positives of behavioral detections from IOA based detections based on a file hash

D.

Reduce false positives of behavioral detections from Custom IOA and OverWatch detections only

How does a DNSRequest event link to its responsible process?

A.

Via both its ContextProcessld__decimal and ParentProcessld_decimal fields

B.

Via its ParentProcessld_decimal field

C.

Via its ContextProcessld_decimal field

D.

Via its TargetProcessld_decimal field

The Bulk Domain Search tool contains Domain information along with which of the following?

A.

Process Information

B.

Port Information

C.

IP Lookup Information

D.

Threat Actor Information

A responder wants to verify why a certain quarantined file was not uploaded to the cloud. Which specific policy dictates whether quarantined files are permitted to be uploaded?

A.

Sensor Update Policy

B.

Prevention Policy

C.

Response Policy

D.

Quarantine Management Policy

A responder is analyzing a process tree where a suspicious executable is listed as a direct child of services.exe. In this scenario, which source is most likely responsible for the execution?

A.

An interactive user login via RDP.

B.

A Windows Service or a process launched by the Service Control Manager.

C.

A web browser download initiated by the end user.

D.

A script executed directly from a removable USB drive.

To manage the lifecycle of security incidents and review new alerts, a responder must navigate through the Falcon sidebar to which specific location?

A.

Investigate > Host Search > Alerts

B.

Endpoint Security > Monitor > Endpoint Detections

C.

Configuration > Security Policies > Detections

D.

Dashboards > Global Activity > Security Alerts

What happens when a quarantined file is released?

A.

It is moved into theC:\CrowdStrike\Quarantine\Releasedfolder on the host

B.

It is allowed to execute on the host

C.

It is deleted

D.

It is allowed to execute on all hosts

What is an advantage of using a Process Timeline?

A.

Process related events can be filtered to display specific event types

B.

Suspicious processes are color-coded based on their frequency and legitimacy over time

C.

Processes responsible for spikes in CPU performance are displayed overtime

D.

A visual representation of Parent-Child and Sibling process relationships is provided

Analyze the following process lineage observed during a detection triage on a Windows 10 workstation:

root > smss.exe > winlogon.exe > userinit.exe > explorer.exe > windows_media_player_y35s21-4ak.exe.

Based on the fact that the suspicious process originated from the user ' s desktop shell environment (explorer.exe), what is the most likely entry vector for this attack?

A.

Remote exploitation of a system service

B.

User execution via a Phishing email or drive-by download

C.

Malicious persistence via a WMI event subscription

D.

Credential theft through a compromised Domain Controller

While the host timeline is comprehensive, some data is not included in that specific view. Which of the following CANNOT be seen directly from the host timeline?

A.

Timestamp

B.

Event Name

C.

PID (Process ID)

D.

CPU Temperature