Online Access Free CCFR-201 Practice Test

What does the Full Detection Details option provide?

• A.It provides detailed list of detection events via the Process Table View
• B.It provides a detailed list of detection events via the Process Tree View
• C.It provides a visualization of program ancestry via the Process Tree View
• D.It provides a visualization of program ancestry via the Process Activity View

From the Detections page, how can you view 'in-progress' detections assigned to Falcon Analyst Alex?

• A.Filter on 'Hostname: Alex' and 'Status: In-Progress'
• B.Alex does not have the correct role permissions as a Falcon Analyst to be assigned detections
• C.Filter on 'Status: In-Progress' and 'Assigned-to: Alex*
• D.Filter on'Analyst: Alex'

Which option indicates a hash is allowlisted?

• A.Always Block
• B.No Action
• C.Ignore
• D.Allow

From a detection, what is the fastest way to see children and sibling process information?

• A.Select Full Detection Details from the detection
• B.Select the Event Search option. Then from the Event Actions, select Show Associated Event Data (From TargetProcessld_decimal)
• C.Select the Process Timeline feature, enter the AID. Target Process ID, and Parent Process ID
• D.Right-click the process and select "Follow Process Chain"

You receive an email from a third-party vendor that one of their services is compromised,thevendor names a specific IP address that the compromised service was using. Where would you input this indicator to find any activity related to this IP address?

• A.IP Addresses
• B.Remote Access Graph
• C.Hash Executions
• D.Remote or Network Logon Activity