Summer Sale Special - Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: sntaclus

examout.co

How long are quarantined files stored in the CrowdStrike Cloud?

A.

45 Days

B.

90 Days

C.

Days

D.

Quarantined files are not deleted

After running an Event Search, you can select many Event Actions depending on your results. Which of the following is NOT an option for any Event Action?

A.

Draw Process Explorer

B.

Show a +/- 10-minute window of events

C.

Show a Process Timeline for the responsible process

D.

Show Associated Event Data (from TargetProcessld_decimal or ContextProcessld_decimal)

Within the context of CrowdStrike’s behavioral detection engine, what does the acronym ' IOA ' stand for?

A.

Indicator of Activity

B.

Indicator of Attack

C.

Integrated Operation Alert

D.

Internal Objective Analysis

When performing a ' Hash Search ' , which of the following is NOT a filter available for use?

A.

SHA256

B.

MD5

C.

File Type

D.

Filename

In the Hash Search tool, which of the following is listed under Process Executions?

A.

Operating System

B.

File Signature

C.

Command Line

D.

Sensor Version

When reviewing CrowdScore Incidents, which of the following statements is INCORRECT?

A.

Incidents aggregate related detections to reduce alert fatigue.

B.

Incidents are defined as inactive after 10 hours pass without any new related activity.

C.

A high CrowdScore indicates a higher likelihood of a sophisticated or widespread attack.

D.

CrowdScore is only visible to users with the ' Falcon Administrator ' role.

Which of the following is returned from the IP Search tool?

A.

IP Summary information from Falcon events containing the given IP

B.

Threat Graph Data for the given IP from Falcon sensors

C.

Unmanaged host data from system ARP tables for the given IP

D.

IP Detection Summary information for detection events containing the given IP

The Falcon console integrates heavily with the MITRE ATT AND CK framework to provide industry-standard context. Which of the following tactics displayed in the detection UI is a direct implementation of a MITRE ATT AND CK tactic?

A.

Malware Action

B.

Impact

C.

Intelligence-Based Match

D.

Script-Based Execution

The Falcon sensor is designed to provide deep visibility into endpoint activity, yet it is not omniscient. According to the Cyber Kill Chain model, which of the following stages does the Falcon sensor typically NOT have visibility over?

A.

Exploitation of a memory-resident vulnerability

B.

Installation of a persistent backdoor

C.

Weaponization of a malicious payload on the adversary ' s infrastructure

D.

Delivery of a malicious document via an encrypted email attachment

What happens when a hash is set to Always Block through IOC Management?

A.

Execution is prevented on all hosts by default

B.

Execution is prevented on selected host groups

C.

Execution is prevented and detection alerts are suppressed

D.

The hash is submitted for approval to be blocked from execution once confirmed by Falcon specialists