Ace Your CCFR-201b CCFR Exam

A list of every time a user has logged in or out of the machine.

Every host-relevant event (Process, File, Registry, Network) recorded in a given timeframe.

A history of every hardware change or driver update on the endpoint.

A log of every time the Falcon sensor was updated or restarted.

It contains the TargetProcessld_decimal value for other related events

It contains an internal value not useful for an investigation

It contains the ContextProcessld_decimal value for the parent process that made the DNS request

It contains the TargetProcessld_decimal value for the process that made the DNS request

It is a system process responsible for the Local Security Authority subsystem.

It is the primary process responsible for the File Explorer UI and the user ' s desktop environment.

It is the Windows Command Processor used for executing batch files.

It is the service control manager that handles the starting of background tasks.

It is deleted from the disk and a log is sent to the cloud.

It is moved to the CrowdStrike Cloud and removed from the local host immediately.

It is compressed, password protected, and moved to the Quarantine folder on the endpoint.

It is renamed to a .tmp extension and moved to the Windows Recycle Bin.