Question 41

When investigating system-level persistence, it is critical to know what the services.exe process is responsible for. What is its primary function?
  • Question 42

    When training a new team member on how to interpret Falcon telemetry, a senior responder explains the definition of a 'Tactic'. Which of the following sentences best captures the technical definition of a Tactic in this context?
  • Question 43

    Your lead analyst instructs you to dump the kernel memory of a Windows system using Real Time Response (RTR).
    Which native RTR command best helps you to quickly achieve the task?
  • Question 44

    To perform a deep-dive investigation into a specific detection, a responder needs to pivot to a process timeline. What is the minimum information required to be gathered from the detection before making this pivot?
  • Question 45

    By default, when a file is quarantined by the Falcon sensor to prevent execution, how many days does that file remain on the host's local disk?