最新的CrowdStrike Certified Falcon Responder - CCFR-201免費考試真題

A. It is allowed to execute on all hosts

B. It is allowed to execute on the host

C. It is moved into theC:\CrowdStrike\Quarantine\Releasedfolder on the host

D. It is deleted

A. Unmanaged host data from system ARP tables for the given IPD.IP Detection Summary information for detection events containing the given IP

B. Threat Graph Data for the given IP from Falcon sensors

C. IP Summary information from Falcon events containing the given IP

A. IP searches allow for multiple comma separated IPv6 addresses as input

B. IP searches provide host, process, and organizational unit data without the need to write a query

C. IP searches offer shortcuts to launch response actions and network containment on target hosts

D. IP searches provide manufacture and timezone data that can not be accessed anywhere else

A. Via its TargetProcessld_decimal field

B. Via its ParentProcessld_decimal field

C. Via its ContextProcessld_decimal field

D. Via both its ContextProcessld__decimal and ParentProcessld_decimal fields

A. User Name

B. Detection ID

C. Event Types

D. Severity

A. Windows\temp\Drivers\CrowdStrike\Quarantine

B. Windows\System32\Drivers\CrowdStrike\Quarantine

C. Windows\Quarantine

D. Windows\System32\

A. From the Detections Dashboard, you right-click the event type you wish to export and choose CSV.JSON or XML

B. You can't export detailed event data from a detection, you have to use the Process Timeline or an Event Search

C. In Full Detection Details, you expand the nodes of the process tree you wish to expand and then click the "Export Process Events" button

D. In Full Detection Details, you choose the "View Process Activity" option and then export from that view