Summer Sale Special - Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: sntaclus

examout.co

What actions are available for domain name-based Indicators of Compromise (IOCs) in Falcon?

A.

Detect only

Allow

B.

Block

Detect only

Allow

C.

Block

Allow

No action

D.

Detect only

No action

Falcon uses specific identifiers to track processes across the environment. Which of the following sentences best describes what the ' TargetProcessId_decimal ' raw data represents?

A.

The standard Process ID (PID) assigned by the Windows operating system.

B.

A sensor-assigned decimal number that is unique for each process across time and hosts.

C.

The memory address where the process’s executable is loaded.

D.

The total number of seconds the process has been running.

From a detection, what is the fastest way to see children and sibling process information?

A.

Select the Event Search option. Then from the Event Actions, select Show Associated Event Data (From TargetProcessld_decimal)

B.

Select Full Detection Details from the detection

C.

Right-click the process and select " Follow Process Chain "

D.

Select the Process Timeline feature, enter the AID. Target Process ID, and Parent Process ID

While reviewing the ' Detection Method ' field for a high-severity alert, a responder sees the label ' Post-Exploit ' . This terminology is used by CrowdStrike to identify a specific:

A.

Falcon Detection Method

B.

MITRE Tactic

C.

Indicator of Attack (IOA)

D.

Prevention Policy Level

Which of the following statements about the ' Hash Search ' (Single Search) is TRUE?

A.

It can search for both files and registry keys simultaneously.

B.

It identifies the geographical location of the file ' s creator.

C.

The ' Hash Written History ' section is only available for SHA256 hashes.

D.

It is primarily used to isolate a host from the network.

A responder is explaining the quarantine process to a system administrator. What happens technically when a file is quarantined by the Falcon sensor?

A.

It is deleted from the disk and a log is sent to the cloud.

B.

It is moved to the CrowdStrike Cloud and removed from the local host immediately.

C.

It is compressed, password protected, and moved to the Quarantine folder on the endpoint.

D.

It is renamed to a .tmp extension and moved to the Windows Recycle Bin.

Where are quarantine files located on a Mac Endpoint?

A.

/tmp/cs/quarantine

B.

/Library/CS/Quarantine

C.

/Applications/Falcon/Quarantine

D.

/Users/Shared/CS/Quarantine

A security analyst is triaging a high-severity alert on a critical production server. To understand the adversary ' s intent and technical execution within the framework of industry standards, the analyst refers to the console ' s categorization. Which specific methodology does CrowdStrike utilize within the Falcon platform to classify detections based on technical behavior?

A.

MITRE-Based Falcon Detections Framework

B.

NIST Incident Response Lifecycle

C.

Falcon Adversary Attribution Matrix

D.

Cyber Kill Chain Classification

What information does the MITRE ATT AND CK Framework provide?

A.

It provides best practices for different cybersecurity domains, such as Identify and Access Management

B.

It provides a step-by-step cyber incident response strategy

C.

It provides the phases of an adversary ' s lifecycle, the platforms they are known to attack, and the specific methods they use

D.

It is a system that attributes an attack techniques to a specific threat actor

When analyzing the raw telemetry for a ' DNSRequest ' event, which of the following raw data fields is available to the responder?

A.

browser_type

B.

index

C.

cpu_usage_percent

D.

monitor_mode