Online Access Free CCFR-201 Practice Test

What are Event Actions?

• A.Raw Falcon event data
• B.Pivotable hyperlinks available in a Host Search
• C.Automated searches that can be used to pivot between related events and searches
• D.Custom event data queries bookmarked by the currently signed in Falcon user

Which is TRUE regarding a file released from quarantine?

• A.It is deleted
• B.No executions are allowed for 14 days after release
• C.It will not generate future machine learning detections on the associated host
• D.It is allowed to execute on all hosts

After pivoting to an event search from a detection, you locate the ProcessRollup2 event. Which two field values are you required to obtain to perform a Process Timeline search so you can determine what the process was doing?

• A.aid and TargetProcessld_decimal
• B.SHA256 and ParentProcessld_decimal
• C.aid and ParentProcessld_decimal
• D.SHA256 and TargetProcessld_decimal

What happens when a hash is allowlisted?

• A.Execution is allowed on all hosts that fall under the organization's CID
• B.The hash is submitted for approval to be allowed to execute once confirmed by Falcon specialists
• C.Execution is allowed on all hosts, including all other Falcon customers
• D.Execution is prevented, but detection alerts are suppressed

Which of the following is NOT a valid event type?

• A.StartofProcess
• B.ProcessRollup2
• C.DnsRequest
• D.EndofProcess