QUESTION: 21

When reviewing a Host Timeline, which of the following filters is available?

Severity
Event Types
User Name
Detection ID

Answer(s): B

Explanation:

According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Host Timeline tool allows you to view all events recorded by the sensor for a given host in a chronological order. The events include process executions, file writes, registry modifications,

network connections, user logins, etc. You can use various filters to narrow down the events based on criteria such as event type, timestamp range, file name, registry key, network destination, etc. However, there is no filter for severity, user name, or detection ID, as these are not attributes of the events.

Reveal Solution Next Question

QUESTION: 22

In the "Full Detection Details", which view will provide an exportable text listing of events like DNS requests. Registry Operations, and Network Operations?

The data is unable to be exported
View as Process Tree
View as Process Timeline
View as Process Activity

Answer(s): D

Explanation:

According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Full Detection Details tool allows you to view detailed information about a detection, such as detection ID, severity, tactic, technique, description, etc. You can also view the events generated by the processes involved in the detection in different ways, such as process tree, process timeline, or process activity. The process activity view provides a rows-and-columns style view of the events, such as DNS requests, registry operations, network operations, etc. You can also export this view to a CSV file for further analysis.

Reveal Solution Next Question

QUESTION: 23

When examining a raw DNS request event, you see a field called ContextProcessld_decimal.
What is the purpose of that field?

It contains the TargetProcessld_decimal value for other related events
It contains an internal value not useful for an investigation
It contains the ContextProcessld_decimal value for the parent process that made the DNS request
It contains the TargetProcessld_decimal value for the process that made the DNS request

Answer(s): D

Explanation:

According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the ContextProcessld_decimal field contains the decimal value of the process ID of the process that generated the event. This field can be used to trace the process lineage and identify malicious or suspicious activities. For a DNS request event, this field indicates which process made the DNS request.

Reveal Solution Next Question

QUESTION: 24

You found a list of SHA256 hashes in an intelligence report and search for them using the Hash Execution Search.
What can be determined from the results?

Identifies a detailed list of all process executions for the specified hashes
Identifies hosts that loaded or executed the specified hashes
Identifies users associated with the specified hashes
Identifies detections related to the specified hashes

Answer(s): B

Explanation:

According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Hash Execution Search tool allows you to search for one or more SHA256 hashes and view a summary of information from Falcon events that contain those hashes. The summary includes the hostname, sensor ID, OS, country, city, ISP, ASN, and geolocation of the host that loaded or executed those hashes. You can also see a count of detections and incidents related to those hashes.

Reveal Solution Next Question

Free CCFR-201 Exam Braindumps (page: 6)

QUESTION: 21

Explanation:

QUESTION: 22

Explanation:

QUESTION: 23

Explanation:

QUESTION: 24

Explanation: