QUESTION: 21

Which of the following is a way to create event searches that run automatically and recur on a schedule that you set?

Workflows
Event Search
Scheduled Searches
Scheduled Reports

Answer(s): C

QUESTION: 22

Which of the following is a recommended technique to find unique outliers among a set of data in the Falcon Event Search?

Hunt-and-Peck Search Methodology
Stacking (Frequency Analysis)
Time-based Searching
Machine Learning

Answer(s): B

Reveal Solution Next Question

Adversaries commonly execute discovery commands such as net.exe, ipconfig.exe, and whoami.exe. Rather than query for each of these commands individually, you would like to use a single query with all of them. What Splunk operator is needed to complete the following query? aid=my-aid event_simpleName=ProcessRollup2 (FileName=net.exe __________ FileName=ipconfig.exe _________ FileName=whoami.exe) | table ComputerName UserName FileName CommandLine

OR
IN
NOT
AND

Answer(s): A

Reveal Solution Next Question

QUESTION: 24

You would like to search for ANY process execution that used a file stored in the Recycle Bin on a Windows host. Select the option to complete the following EAM query. aid=my-aid ImageFileName=________ event_simpleName=ProcessRollup2

*$Recycle.Bin^
*$Recycle.Bin*
^$Recycle.Bin*
^$Recycle.Bin%

Answer(s): B

Reveal Solution Next Question

Free CCFH-202 Exam Braindumps (page: 7)

QUESTION: 21

QUESTION: 22

QUESTION: 23

QUESTION: 24

CCFH-202 Discussions & Posts