CrowdStrike Certified Falcon Responder - CCFR-201 Exam Practice Test

A. It allows you to input an event type, such as DNS Request or ASEP write, and search for those events within the detection

B. It takes you to a Process Timeline for that detection so you can see all related events

C. It gives you the ability to search for similar events on other endpoints quickly

D. It takes you to the raw Insight event data and provides you with a number of Event Actions

A. In Full Detection Details, you expand the nodes of the process tree you wish to expand and then click the "Export Process Events" button

B. From the Detections Dashboard, you right-click the event type you wish to export and choose CSV.JSON or XML

C. In Full Detection Details, you choose the "View Process Activity" option and then export from that view

D. You can't export detailed event data from a detection, you have to use the Process Timeline or an Event Search

A. Filter on 'Hostname: Alex' and 'Status: In-Progress'

B. Alex does not have the correct role permissions as a Falcon Analyst to be assigned detections

C. Filter on'Analyst: Alex'

D. Filter on 'Status: In-Progress' and 'Assigned-to: Alex*

A. Local Prevalence tells you how common the hash of the triggering file is within your environment (CID)

B. Local Prevalence is the Virus Total score for the hash of the triggering file

C. Local prevalence is the frequency with which the hash of the triggering file is seen across the entire Internet

D. Local prevalence is the frequency with which the hash of the triggering file is seen across all CrowdStrike customer environments

A. Scheduled tasks registered prior to the detection

B. User logons after the detection

C. Executions of schtasks.exe after the detection

D. Pivot to a Hash search for taskeng.exe

A. Quarantined files are not deleted

B. Days

C. 90 Days

D. 45 Days

A. A view of activities on Mac or Linux hosts

B. Only detection process-related events within a given timeframe

C. All cloudable events for a specific host

D. All cloudable process-related events within a given timeframe