Summer Sale Special - Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: sntaclus

examout.co

A responder decides to set a specific Custom IOA to the ' Monitor ' action. Which of the following sentences best describes the technical result of this choice?

A.

The sensor will block the activity and alert the user with a pop-up.

B.

The sensor will create detections with ' Informational ' severity but will not block the activity.

C.

The sensor will log the activity in the audit logs but will not generate a detection.

D.

The sensor will automatically isolate the host from the network.

During the configuration of a new IOA rule, the administrator must decide what action the sensor should take. Which of the following is NOT a valid IOA rule action?

A.

Monitor

B.

Block

C.

No Action

D.

Kill Process

Executive dashboards provide a high-level view of security. Which of the following CANNOT be seen from the Executive Summary Dashboard?

A.

Detections broken down by Tactic.

B.

A breakdown of Agent Versions across the fleet.

C.

The top 10 hosts with the most detections.

D.

The organization’s current CrowdScore trend.

Which of the following sentences best describes the primary objective of ' Real-time Analysis ' within the Falcon platform?

A.

Analyzing historical logs from the past 90 days to find missed threats.

B.

Investigating incoming telemetry in real time or on a near real-time basis to catch active threats.

C.

Scanning every file on a hard drive once per week for dormant viruses.

D.

Manually updating the Falcon sensor on every machine in the fleet.

What happens when a quarantined file is released?

A.

It is moved into theC:\CrowdStrike\Quarantine\Releasedfolder on the host

B.

It is allowed to execute on the host

C.

It is deleted

D.

It is allowed to execute on all hosts

When viewing the main ' Quarantine ' dashboard to manage blocked files, which of the following pieces of information CANNOT be seen by default?

A.

Filename

B.

Host Name

C.

Hash

D.

Date Quarantined

What action is needed to ensure Falcon does not block or generate a detection for a process by using the file hash?

A.

Create a Custom IOC with an action of allow for the hash

B.

Create a Machine Learning Exclusion with an action of allow for the hash

C.

Create a Custom IOA with an action of allow for the hash

D.

Create an IOA Exclusion with an action of allow for the hash

The Bulk Domain Search tool contains Domain information along with which of the following?

A.

Process Information

B.

Port Information

C.

IP Lookup Information

D.

Threat Actor Information

When an analyst is trying to pinpoint the exact moment an endpoint came online after being shut down for the weekend, which timeline view is the best to use?

A.

Process Timeline

B.

Host Timeline

C.

User Timeline

D.

Network Timeline

While quarantined files stay on the local host for 30 days by default, how many days does a quarantined file remain stored in the CrowdStrike Cloud?

A.

30 days

B.

60 days

C.

90 days

D.

180 days