CCFR-201b Exam Question 41
After running an Event Search, you can select many Event Actions depending on your results. Which of the following is NOT an option for any Event Action?
CCFR-201b Exam Question 42
The Process Activity View provides a rows-and-columns style view of the events generated in a detection.
Why might this be helpful?
Why might this be helpful?
CCFR-201b Exam Question 43
Evaluate the following process tree observed in a detection:
root > smss.exe > winlogon.exe > userinit.exe > explorer.exe > windows_media_player_y35s21-4ak.exe Based on the parent-child relationships, which entry source is most likely?
root > smss.exe > winlogon.exe > userinit.exe > explorer.exe > windows_media_player_y35s21-4ak.exe Based on the parent-child relationships, which entry source is most likely?
CCFR-201b Exam Question 44
A responder is explaining the quarantine process to a system administrator. What happens technically when a file is quarantined by the Falcon sensor?
CCFR-201b Exam Question 45
In the "Full Detection Details", which view will provide an exportable text listing of events like DNS requests. Registry Operations, and Network Operations?
