In the Hash Search tool, which of the following is listed under Process Executions?
Answer : C
According to theCrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Hash Search tool allows you to search for one or more SHA256 hashes and view a summary of information from Falcon events that contain those hashes1.The summary includes the hostname, sensor ID, OS, country, city, ISP, ASN, geolocation, process name, command line, and organizational unit of the host that loaded or executed those hashes1.You can also see a count of detections and incidents related to those hashes1.Under Process Executions, you can see the process name and command line for each hash execution1.
Question 2
In the "Full Detection Details", which view will provide an exportable text listing of events like DNS requests. Registry Operations, and Network Operations?
Answer : D
According to theCrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Full Detection Details tool allows you to view detailed information about a detection, such as detection ID, severity, tactic, technique, description, etc1.You can also view the events generated by the processes involved in the detection in different ways, such as process tree, process timeline, or process activity1.The process activity view provides a rows-and-columns style view of the events, such as DNS requests, registry operations, network operations, etc1.You can also export this view to a CSV file for further analysis1.
Question 3
Where are quarantined files stored on Windows hosts?
Answer : B
According to theCrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, when you quarantine a file from a host using IOC Management or Real Time Response (RTR), you are moving it from its original location to a secure location on the host where it cannot be executed2.The file is also encrypted and renamed with a random string of characters2.On Windows hosts, quarantined files are stored in C:\Windows\System32\Drivers\CrowdStrike\Quarantine folder2.
Question 4
Which of the following is NOT a filter available on the Detections page?
Answer : D
According to theCrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, the Detections page allows you to view and manage detections generated by the CrowdStrike Falcon platform2.You can use various filters to narrow down the detections based on criteria such as severity, CrowdScore, time, tactic, technique, etc2.However, there is no filter for triggering file, which is the file that caused the detection2.
Question 5
What does pivoting to an Event Search from a detection do?
Answer : B
According to theCrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, pivoting to an Event Search from a detection takes you to the raw Insight event data and provides you with a number of Event Actions1.Insight events are low-level events that are generated by the sensor for various activities, such as process executions, file writes, registry modifications, network connections, etc1.You can view these events in a table format and use various filters and fields to narrow down the results1.You can also select one or more events and perform various actions, such as show a process timeline, show a host timeline, show associated event data, show a +/- 10-minute window of events, etc1.These actions can help you investigate and analyze events more efficiently and effectively1.
Question 6
From the Detections page, how can you view 'in-progress' detections assigned to Falcon Analyst Alex?
Answer : D
According to theCrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, the Detections page allows you to view and manage detections generated by the CrowdStrike Falcon platform2.You can use various filters to narrow down the detections based on criteria such as status, severity, tactic, technique, etc2.To view 'in-progress' detections assigned to Falcon Analyst Alex, you can filter on 'Status: In-Progress' and 'Assigned-to: Alex*'2.The asterisk (*) is a wildcard that matches any characters after Alex2.
Question 7
What happens when a hash is allowlisted?
Answer : D
According to theCrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, the allowlist feature allows you to exclude files or directories from being scanned or blocked by CrowdStrike's machine learning engine or indicators of attack (IOAs)2.This can reduce false positives and improve performance2.When you allowlist a hash, you are allowing that file to execute on any host that belongs to your organization's CID (customer ID)2.This does not affect other Falcon customers or hosts outside your CID2.
All Official Question Types