Summer Sale Special - Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: sntaclus

examout.co

When reviewing the data within a process timeline, what specific type of information is being displayed to the responder?

A.

A capture of all raw network packets sent by the process.

B.

All cloudable process-related events (files written, network connections, etc.) for that process in a given timeframe.

C.

A list of every user who has ever logged into that specific endpoint.

D.

A summary of the hardware performance metrics during the time of the detection.

To ensure that a malicious file cannot be accidentally executed or accessed by other processes, how are quarantined files stored on the local endpoints?

A.

They are hidden within the Windows System32 directory.

B.

They are stored in an encrypted format.

C.

They are renamed with a random 32-character extension.

D.

They are moved to a password-protected ZIP file on the desktop.

Responders must understand the limitations and capabilities of custom rules. Which of the following statements about custom IOAs is FALSE?

A.

They can be used to monitor or block specific command-line strings.

B.

A Custom IOA rule group can only be applied to one single prevention policy.

C.

They can generate ' Informational ' detections if set to the ' Monitor ' action.

D.

They allow for pattern matching using wildcards or specific strings.

What must be true about a custom script before it can be executed from within a Fusion SOAR Workflow?

A.

The Response Policy must allow for the execution of Workflows

B.

The script must exist on the host locally

C.

The script must contain input and output JSON fields

D.

The Share with workflows option must be enabled for the custom script

From the Detections page, how can you view ' in-progress ' detections assigned to Falcon Analyst Alex?

A.

Filter on ' Analyst: Alex '

B.

Alex does not have the correct role permissions as a Falcon Analyst to be assigned detections

C.

Filter on ' Hostname: Alex ' and ' Status: In-Progress '

D.

Filter on ' Status: In-Progress ' and ' Assigned-to: Alex*

You are responding to a cybersecurity incident and observe several outbound network connections from host Bob-Desktop. Upon review, you determine this to be a result of a Threat Actor ' s attempt to exfiltrate data.

What action should you take to stop the exfiltration using the Falcon Platform?

A.

Use the Falcon console to network contain Bob-Desktop

B.

Access Bob-Desktop via RTR and run the contain command

C.

Find the IP address associated with the exfiltration and block it by creating an IOA

D.

Find the IP address associated with the exfiltration and block it by creating an IOC

An executive asks for a definition of ' CrowdScore ' . Which of the following sentences best describes what CrowdScore is?

A.

It is a ranking system that compares your organization’s security to other companies.

B.

It is a metric designed to show an organization ' s threat level on a continual basis by aggregating related detections.

C.

It is the total number of detections that have been resolved within the last 24 hours.

D.

It is a measure of the total processing power being used by the Falcon sensors globally.

To manage the lifecycle of security incidents and review new alerts, a responder must navigate through the Falcon sidebar to which specific location?

A.

Investigate > Host Search > Alerts

B.

Endpoint Security > Monitor > Endpoint Detections

C.

Configuration > Security Policies > Detections

D.

Dashboards > Global Activity > Security Alerts

A responder is looking at event telemetry and sees an event named ' ProcessRollup2 ' . Which sentence best describes what this event type represents?

A.

An existing process was terminated by the user.

B.

A new process was created and started on the endpoint.

C.

A process successfully established a network connection.

D.

A process modified a sensitive registry key.