How long does detection data remain in the CrowdStrike Cloud before purging begins?
In the full detection tree view, icons provide visual cues about the telemetry. What does the specific icon representing a ' Falcon ' (blue bird) indicate to the responder?
You are reviewing the raw data in an event search from a detection tree. You find a FileOpenlnfo event and want to find out if any other files were opened by the responsible process. Which two field values do you need from this event to perform a Process Timeline search?
You are pre-staging a Custom IOC for later use and want to save a file hash for later use after approval.
Which action should you use?
How are processes on the same plane ordered (bottom ' VMTOOLSD.EXE ' to top CMD.EXE ' )?
From the Detections page, how can you view ' in-progress ' detections assigned to Falcon Analyst Alex?
A responder decides to set a specific Custom IOA to the ' Monitor ' action. Which of the following sentences best describes the technical result of this choice?
Multiple detections with the process schtasks.exe begin to alert in the UI. The process executes the following command line on several unique hosts:
schtasks.exe /Query /TN " Qljsscdqr "
What is the most efficient way to identify which hosts are executing this scheduled task?
Which of the following sentences best describes the primary objective of ' Real-time Analysis ' within the Falcon platform?
You are reviewing the raw data in an Event Search from a detection tree. You find a DnsRequest event and want to determine whether any other DNS requests were performed by the original process.
Which two field values do you need from this event to perform a Process Timeline search?
Which tool or search type is recommended as the " best search " to use when performing the " Examine what ' s normal for this system " step in an investigation?
Following a detection involving a suspected ransomware binary, the Falcon sensor automatically takes a prevention action to prevent the file from executing. An analyst needs to retrieve this file for local sandbox analysis. Considering the default configuration, for how many days will this file remain stored in the encrypted quarantine folder on the local endpoint?
A responder is analyzing a process tree where a suspicious executable is listed as a direct child of services.exe. In this scenario, which source is most likely responsible for the execution?
Aside from a Process Timeline or Event Search, how do you export process event data from a detection in .CSV format?
In the ' Investigate > Hunt > Linux Sensors ' dashboard, responders can view various Linux-specific activities. Which of the following sub-titling is NOT displayed in this dashboard?
Within the MITRE-Based Falcon Detections Framework, what is the correct way to interpret Keep Access > Persistence > Create Account?
While reviewing the high-level organizational structure of a complex detection in the Falcon console, a responder identifies several layers of activity. Which of the following is NOT officially recognized as an Objective Layer within the CrowdStrike detection hierarchy?
CrowdStrike provides ' Overwatch Best Practices ' for triaging alerts. According to these guidelines, what is the next step a responder should take immediately after the ' Understand the detection ' step?
In the " Full Detection Details " , which view will provide an exportable text listing of events like DNS requests. Registry Operations, and Network Operations?
You are notified by a third-party that a program may have redirected traffic to a malicious domain. Which Falcon page will assist you in searching for any domain request information related to this notice?
A responder needs to view a high-level overview of the environment ' s security posture. Where can they find the ' Activity Dashboard ' ?
You are responding to a cybersecurity incident and observe several outbound network connections from host Bob-Desktop. Upon review, you determine this to be a result of a Threat Actor ' s attempt to exfiltrate data.
What action should you take to stop the exfiltration using the Falcon Platform?
During the configuration of a new IOA rule, the administrator must decide what action the sensor should take. Which of the following is NOT a valid IOA rule action?
When an organization needs to detect a specific behavior that is unique to their environment, they can create a Custom IOA. Which of the following is NOT required when configuring a custom IOA from scratch?
If a local administrator needs to inspect the quarantine directory directly on a machine, where are quarantine files located on a Windows Endpoint?
A responder wants to verify why a certain quarantined file was not uploaded to the cloud. Which specific policy dictates whether quarantined files are permitted to be uploaded?
The Falcon console integrates heavily with the MITRE ATT AND CK framework to provide industry-standard context. Which of the following tactics displayed in the detection UI is a direct implementation of a MITRE ATT AND CK tactic?
While reviewing the ' Detection Method ' field for a high-severity alert, a responder sees the label ' Post-Exploit ' . This terminology is used by CrowdStrike to identify a specific:
What happens when you create a Sensor Visibility Exclusion for a trusted file path?
When investigating system-level persistence, it is critical to know what the services.exe process is responsible for. What is its primary function?
CrowdStrike implements a specific framework within the Falcon console to help responders categorize detections based on the adversary’s ultimate goals and the technical means used to achieve them. This classification system, which maps activity to known industry standards, is known as the:
To track the relationship between a parent and its child, Falcon uses specific ID fields. What raw data is used as the ' ParentProcessId_decimal ' when a process spawns a child process?
The Bulk Domain Search tool contains Domain information along with which of the following?
The Falcon sensor can take several automated actions to protect an endpoint. Which of the following is NOT an action that Falcon takes upon detection?
When an analyst is trying to pinpoint the exact moment an endpoint came online after being shut down for the weekend, which timeline view is the best to use?
You are tasked with remediating adware for a host using a custom script via Real Time Response (RTR). When running the script, you get an error that the script is timing out.
How can you resolve this issue?
When viewing the main ' Quarantine ' dashboard to manage blocked files, which of the following pieces of information CANNOT be seen by default?
When navigating the ' Custom IOA ' creation wizard, a user must select a rule type. Which of the following is NOT a valid IOA rule type available for selection?
You receive an email from a third-party vendor that one of their services is compromised,thevendor names a specific IP address that the compromised service was using. Where would you input this indicator to find any activity related to this IP address?
When a responder chooses to ' Release ' a file from quarantine because it was determined to be a false positive, what type of allowlist is automatically created in the background?
A responder wants to include a visual representation of a process tree in an incident report. Which of the following is NOT a valid way to export process data from ' Full Detection Details ' ?
Analyze the following process lineage observed during a detection triage on a Windows 10 workstation:
root > smss.exe > winlogon.exe > userinit.exe > explorer.exe > windows_media_player_y35s21-4ak.exe.
Based on the fact that the suspicious process originated from the user ' s desktop shell environment (explorer.exe), what is the most likely entry vector for this attack?
The Process Activity View provides a rows-and-columns style view of the events generated in a detection. Why might this be helpful?
While in an Event Search, a responder clicks on an event action. What does the ' Show Child Processes ' event action do?
Falcon uses specific identifiers to track processes across the environment. Which of the following sentences best describes what the ' TargetProcessId_decimal ' raw data represents?
When navigating the main ' Detections ' page, several filters are available in the dropdown menu. Which of the following is NOT a filter available in this menu?
When analyzing the raw telemetry for a ' DNSRequest ' event, which of the following raw data fields is available to the responder?
To manage the lifecycle of security incidents and review new alerts, a responder must navigate through the Falcon sidebar to which specific location?
A responder is analyzing a file ' s prevalence. If the data shows ' Local: High ' and ' Global: Unique ' , which of the following is the most likely conclusion?
An analyst needs to quickly view the activity surrounding a suspicious process. Which of the following sequences of steps will pivot to an auto-filled process timeline in the Falcon UI?
Which of the following sentences best describes the primary use of the ' Hash Executions ' Search (Bulk Search)?
When examining a raw DNS request event, you see a field called ContextProcessld_decimal. What is the purpose of that field?
CrowdScore is a metric used to identify the severity of an ongoing incident. What percentage of increase in a CrowdScore is considered a strong indication of a coordinated attack?
Bulk Search tools have several features in common. Which of the following is incorrect as a feature common to all Bulk Search types?
DumpsMate's team of experts is always available to respond your queries on exam preparation. Get professional answers on any topic of the certification syllabus. Our experts will thoroughly satisfy you.
TESTED 19 Aug 2026
