Summer Sale Special - Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: sntaclus

examout.co

If an organization is experiencing several false positives from a specific Machine Learning (ML) detection group and wants to create a tightly-scoped allowlist, which grouping should they use first?

A.

Group by Filename

B.

Group by Hash

C.

Group by Command Line

D.

Group by User

When an analyst downloads a quarantined file from the Falcon UI for offline analysis, what is the specific file format and the required password for extraction?

A.

The file is downloaded as a 7-zip archive and requires the password ' infected ' for extraction.

B.

The file is downloaded in its raw binary format without any encryption or compression.

C.

The file is downloaded as a standard ZIP archive but does not require a password to open.

D.

The file is downloaded as an encrypted .exe that can only be opened by a CrowdStrike sensor.

In the Hash Search tool, which of the following is listed under Process Executions?

A.

Operating System

B.

File Signature

C.

Command Line

D.

Sensor Version

During the incident response process, a responder must update the status of a detection. Which of the following options is NOT a valid detection status recognized by the Falcon console?

A.

New

B.

Complete

C.

In Progress

D.

True Positive

During the configuration of a new IOA rule, the administrator must decide what action the sensor should take. Which of the following is NOT a valid IOA rule action?

A.

Monitor

B.

Block

C.

No Action

D.

Kill Process

In the ' Investigate > Hunt > Linux Sensors ' dashboard, responders can view various Linux-specific activities. Which of the following sub-titling is NOT displayed in this dashboard?

A.

Sudo Executions

B.

Cron Usage

C.

Kernel Module Loads

D.

User Logins

The Process Activity View provides a rows-and-columns style view of the events generated in a detection. Why might this be helpful?

A.

The Process Activity View creates a consolidated view of all detection events for that process that can be exported for further analysis

B.

The Process Activity View will show the Detection time of the earliest recorded activity which might indicate first affected machine

C.

The Process Activity View only creates a summary of Dynamic Link Libraries (DLLs) loaded by a process

D.

The Process Activity View creates a count of event types only, which can be useful when scoping the event

While quarantined files stay on the local host for 30 days by default, how many days does a quarantined file remain stored in the CrowdStrike Cloud?

A.

30 days

B.

60 days

C.

90 days

D.

180 days

How are processes on the same plane ordered (bottom ' VMTOOLSD.EXE ' to top CMD.EXE ' )?

A.

Process ID (Descending, highest on bottom)

B.

Time started (Descending, most recent on bottom)

C.

Time started (Ascending, most recent on top)

D.

Process ID (Ascending, highest on top)

Which of the following sentences best describes the technical visibility provided by the ' Host Timeline ' view?

A.

A list of every time a user has logged in or out of the machine.

B.

Every host-relevant event (Process, File, Registry, Network) recorded in a given timeframe.

C.

A history of every hardware change or driver update on the endpoint.

D.

A log of every time the Falcon sensor was updated or restarted.