CrowdStrike Certified Falcon Responder - CCFR-201b무료 덤프문제 풀어보기
To track the relationship between a parent and its child, Falcon uses specific ID fields. What raw data is used as the ' ParentProcessId_decimal ' when a process spawns a child process?
정답: A
An analyst notices a detection that has been automatically flagged with the ' New Activity ' status. Which of the following statements best describes what this status indicates?
정답: D
The Activity Dashboard is a core feature for security teams. What is the primary purpose of this dashboard?
정답: C
Data retention is a key factor in retrospective hunting. How long will " Detection Related Events " be retained in the Falcon environment?
정답: A
In the full detection tree view, icons provide visual cues about the telemetry. What does the specific icon representing a ' Falcon ' (blue bird) indicate to the responder?
정답: A
CrowdStrike implements a specific framework within the Falcon console to help responders categorize detections based on the adversary's ultimate goals and the technical means used to achieve them. This classification system, which maps activity to known industry standards, is known as the:
정답: A
To understand how a threat moved on a system, a responder must know the role of common processes. Which of the following statements best describes the standard functionality of explorer.exe?
정답: C
The Bulk Domain Search tool contains Domain information along with which of the following?
정답: A
You can jump to a Process Timeline from many views, like a Hash Search, by clicking which of the following?
정답: C
Filtering is essential for managing a high volume of alerts. Which of the following filters is available by default within the ' Endpoint Detections ' dashboard to help narrow down specific threats?
정답: B
When analyzing an executable with a global prevalence of common; but you do not know what the executable is. what is the best course of action?
정답: B
You found a list of SHA256 hashes in an intelligence report and search for them using the Hash Execution Search. What can be determined from the results?
정답: C
Aside from a Process Timeline or Event Search, how do you export process event data from a detection in .
CSV format?
CSV format?
정답: B
How does a DNSRequest event link to its responsible process?
정답: C
You are concerned that a compromised user may have run multiple malicious commands across multiple hosts.
What information from Investigate > Search > Users will help you quickly find evidence of this behavior?
What information from Investigate > Search > Users will help you quickly find evidence of this behavior?
정답: A
설명: (Fast2test 회원만 볼 수 있음)