CCFR-201b Exam Question 41

After running an Event Search, you can select many Event Actions depending on your results. Which of the following is NOT an option for any Event Action?
  • CCFR-201b Exam Question 42

    The Process Activity View provides a rows-and-columns style view of the events generated in a detection.
    Why might this be helpful?
  • CCFR-201b Exam Question 43

    Evaluate the following process tree observed in a detection:
    root > smss.exe > winlogon.exe > userinit.exe > explorer.exe > windows_media_player_y35s21-4ak.exe Based on the parent-child relationships, which entry source is most likely?
  • CCFR-201b Exam Question 44

    A responder is explaining the quarantine process to a system administrator. What happens technically when a file is quarantined by the Falcon sensor?
  • CCFR-201b Exam Question 45

    In the "Full Detection Details", which view will provide an exportable text listing of events like DNS requests. Registry Operations, and Network Operations?