CCFR-201b Practice Questions

A.  

It excludes host information from Detections and Incidents generated within that file path location

B.  

It prevents file uploads to the CrowdStrike cloud from that file path

C.  

It excludes sensor monitoring and event collection for the trusted file path

D.  

It disables detection generation from that path, however the sensor can still perform prevention actions

A.  

It will show a list of computers and process that performed a lookup of any of the domains in your search

B.  

The " Bulk Domains " search will allow you to blocklist your queried domains

C.  

The " Bulk Domains " search will show IP address and port information for any associated connections

D.  

A.  

reg.exe

B.  

taskmgr.exe

C.  

lsass.exe

D.  

svchost.exe

A.  

Graph View

B.  

Tree View

C.  

Process Timeline

D.  

List View

A.  

They can be used to monitor or block specific command-line strings.

B.  

A Custom IOA rule group can only be applied to one single prevention policy.

C.  

They can generate ' Informational ' detections if set to the ' Monitor ' action.

D.  

They allow for pattern matching using wildcards or specific strings.

A.  

A capture of all raw network packets sent by the process.

B.  

All cloudable process-related events (files written, network connections, etc.) for that process in a given timeframe.

C.  

A list of every user who has ever logged into that specific endpoint.

D.  

A summary of the hardware performance metrics during the time of the detection.

A.  

A global intelligence report about a new adversary.

B.  

A specific detection that occurred on a particular host.

C.  

The main settings menu of the Falcon console.

D.  

The help documentation in the Support portal.

A.  

An adversary is trying to keep access through persistence by creating an account

B.  

An adversary is trying to keep access through persistence using browser extensions

C.  

An adversary is trying to keep access through persistence using external remote services

D.  

adversary is trying to keep access through persistence using application skimming

A.  

It gives you the ability to search for similar events on other endpoints quickly

B.  

It takes you to the raw Insight event data and provides you with a number of Event Actions

C.  

It takes you to a Process Timeline for that detection so you can see all related events

D.  

It allows you to input an event type, such as DNS Request or ASEP write, and search for those events within the detection

A.  

Host Timeline

B.  

Process Timeline

C.  

User Timeline

D.  

Administrative Timeline