CrowdStrike Certified Falcon Responder - CCFR-201 模擬練習

A. It takes you to a Process Timeline for that detection so you can see all related events

B. It takes you to the raw Insight event data and provides you with a number of Event Actions

C. It allows you to input an event type, such as DNS Request or ASEP write, and search for those events within the detection

D. It gives you the ability to search for similar events on other endpoints quickly

A. Command Line

B. Operating System

C. Sensor Version

D. File Signature

A. View as Process Activity

B. View as Process Tree

C. Thedata is unable to be exported

D. View as Process Timeline

A. Local prevalence is the frequency with which the hash of the triggering file is seen across the entire Internet

B. Local Prevalence tells you how common the hash of the triggering file is within your environment (CID)

C. Local prevalence is the frequency with which the hash of the triggering file is seen across all CrowdStrike customer environments

D. Local Prevalence is the Virus Total score for the hash of the triggering file

A. Filter on'Analyst: Alex'

B. Alex does not have the correct role permissions as a Falcon Analyst to be assigned detections

C. Filter on 'Status: In-Progress' and 'Assigned-to: Alex*

D. Filter on 'Hostname: Alex' and 'Status: In-Progress'

A. Identifies detections related to the specified hashes

B. Identifies users associated with the specified hashes

C. Identifies hosts that loaded or executed the specified hashes

D. Identifies a detailed list of all process executions for the specified hashes

A. A visual representation of Parent-Child and Sibling process relationships is provided

B. Process related events can be filtered to display specific event types

C. Suspicious processes are color-coded based on their frequency and legitimacy over time

D. Processes responsible for spikes in CPU performance are displayed overtime