Responders often need to organize detections to identify trends across the environment. Which of the following is NOT a grouping option currently available on the ' Endpoint Detections ' page?
Sensor Visibility Exclusion patterns are written in which syntax?
While quarantined files stay on the local host for 30 days by default, how many days does a quarantined file remain stored in the CrowdStrike Cloud?
You receive an email from a third-party vendor that one of their services is compromised,thevendor names a specific IP address that the compromised service was using. Where would you input this indicator to find any activity related to this IP address?
An administrator needs to download a file for analysis that was blocked by the sensor. Where are quarantine files located within the Falcon UI?
A responder is explaining the quarantine process to a system administrator. What happens technically when a file is quarantined by the Falcon sensor?
A security responder is investigating a detection where a low-privileged process attempted to manipulate a system token to gain administrative rights. Within the specific terminology used by the Falcon console, ' Privilege Escalation ' is classified as a:
After an investigation, the following malicious artifacts have been identified:
C:\Users*\AppData\iamnotmalware.exe
C:\Users*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iamnotmalware.lnk
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iamnotmalware_really
What method will remove all associated artifacts from hosts that trigger future related detections?
Where are quarantined files stored on Windows hosts?
Which of the following sentences best describes the primary use of the ' Hash Executions ' Search (Bulk Search)?
