QUESTION: 5

What is the difference between a Host Search and a Host Timeline?

Results from a Host Search return information in an organized view by type, while a Host Timeline returns a view of all events recorded by the sensor
A Host Timeline only includes process execution events and user account activity
Results from a Host Timeline include process executions and related events organized by data type. A Host Search returns a temporal view of all events for the given host
There is no difference - Host Search and Host Timeline are different names for the same search page

Answer(s): A

Explanation:

According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Host Search allows you to search for hosts based on various criteria, such as hostname, IP address, OS, etc. The results are displayed in an organized view by type, such as detections, incidents, processes, network connections, etc. The Host Timeline allows you to view all events recorded by the sensor for a given host in a chronological order. The events include process executions, file writes, registry modifications, network connections, user logins, etc.

Reveal Solution Next Question

QUESTION: 6

When examining raw event data, what is the purpose of the field called ParentProcessld_decimal?

It contains an internal value not useful for an investigation
It contains the TargetProcessld_decimal value of the child process
It contains the Sensorld_decimal value for related events
It contains the TargetProcessld_decimal of the parent process

Answer(s): D

Explanation:

According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the ParentProcessld_decimal field contains the decimal value of the process ID of the parent process that spawned or injected into the target process. This field can be used to trace the process lineage and identify malicious or suspicious activities.

Reveal Solution Next Question

QUESTION: 7

What action is used when you want to save a prevention hash for later use?

Always Block
Never Block
Always Allow
No Action

Answer(s): A

Explanation:

According to the CrowdStrike Falcon® Data Replicator (FDR) Add-on for Splunk Guide, the Always Block action allows you to block a file from executing on any host in your organization based on its hash value. This action can be used to prevent known malicious files from running on your endpoints.

Reveal Solution Next Question

QUESTION: 8

A list of managed and unmanaged neighbors for an endpoint can be found:

by using Hosts page in the Investigate tool
by reviewing "Groups" in Host Management under the Hosts page
under "Audit" by running Sensor Visibility Exclusions Audit
only by searching event data using Event Search

Answer(s): A

Explanation:

According to the CrowdStrike Falcon® Data Replicator (FDR) Add-on for Splunk Guide, you can use the Hosts page in the Investigate tool to view information about your endpoints, such as hostname, IP address, OS, sensor version, etc. You can also see a list of managed and unmanaged neighbors for each endpoint, which are other devices that have communicated with that endpoint over the network. This can help you identify potential threats or vulnerabilities in your network.

Reveal Solution Next Question

Free CCFR-201 Exam Braindumps (page: 2)

QUESTION: 5

Explanation:

QUESTION: 6

Explanation:

QUESTION: 7

Explanation:

QUESTION: 8

Explanation: