CrowdStrike CCFR-201 Quiz 1 Topic 1 Questions 1-5

Question: 1

Sensor Visibility Exclusion patterns are written in which syntax?

AGlob Syntax

BKleene Star Syntax

CRegEx

DSPL(Splunk)

Show Answer

Question: 2

The Process Activity View provides a rows-and-columns style view of the events generated in a detection. Why might this be helpful?

AThe Process Activity View creates a consolidated view of all detection events for that process that can be exported for further analysis

BThe Process Activity View will show the Detection time of the earliest recorded activity which might indicate first affected machine

CThe Process Activity View only creates a summary of Dynamic Link Libraries (DLLs) loaded by a process

DThe Process Activity View creates a count of event types only, which can be useful when scoping the event

Show Answer

Question: 3

Which of the following is NOT a filter available on the Detections page?

ASeverity

BCrowdScore

CTime

DTriggering File

Show Answer

Question: 4

What does the Full Detection Details option provide?

AIt provides a visualization of program ancestry via the Process Tree View

BIt provides a visualization of program ancestry via the Process Activity View

CIt provides detailed list of detection events via the Process Table View

DIt provides a detailed list of detection events via the Process Tree View

Show Answer

Question: 5

Which of the following is returned from the IP Search tool?

AIP Summary information from Falcon events containing the given IP

BThreat Graph Data for the given IP from Falcon sensors

CUnmanaged host data from system ARP tables for the given IP D. IP Detection Summary information for detection events containing the given IP

Show Answer

CrowdStrike CCFR-201 Quiz:1 Topic:1 Questions:1-5