Spring Sale Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: pass65
marks4sure logo
While reviewing the 'Detection Method' field for a high-severity alert, a responder sees the label 'Post-Exploit'. This terminology is used by CrowdStrike to identify a specific:
Which of the following sentences best describes the primary use of 'Retrospective Analysis'?
A responder is analyzing a process tree where a suspicious executable is listed as a direct child of services.exe. In this scenario, which source is most likely responsible for the execution?
Executive dashboards provide a high-level view of security. Which of the following CANNOT be seen from the Executive Summary Dashboard?
When a responder chooses to 'Release' a file from quarantine because it was determined to be a false positive, what type of allowlist is automatically created in the background?
While reviewing the high-level organizational structure of a complex detection in the Falcon console, a responder identifies several layers of activity. Which of the following is NOT officially recognized as an Objective Layer within the CrowdStrike detection hierarchy?
The MITRE-Based Falcon Detections Framework is a core component of the Falcon UI. What is the primary operational advantage provided by this framework to a Tier 1 responder?
Following a detection involving a suspected ransomware binary, the Falcon sensor automatically takes a prevention action to prevent the file from executing. An analyst needs to retrieve this file for local sandbox analysis. Considering the default configuration, for how many days will this file remain stored in the encrypted quarantine folder on the local endpoint?
When examining raw event data, what is the purpose of the field called ParentProcessld_decimal?
Filtering is essential for managing a high volume of alerts. Which of the following filters is available by default within the 'Endpoint Detections' dashboard to help narrow down specific threats?
During the triage of a detection involving a newly created persistent task, which specific indicator is most important for a responder to identify the actual intent of the service?
A responder is unsure about the difference between 'Detection' and 'Prevention' settings. Where can they find information about Detection and Prevention Policies?
The Falcon sensor can take several automated actions to protect an endpoint. Which of the following is NOT an action that Falcon takes upon detection?
The Falcon console integrates heavily with the MITRE ATT AND CK framework to provide industry-standard context. Which of the following tactics displayed in the detection UI is a direct implementation of a MITRE ATT AND CK tactic?
When performing a 'Hash Search', which of the following is NOT a filter available for use?
The Bulk Domain Search tool contains Domain information along with which of the following?
A responder is analyzing a MITRE-related alert and sees the technique 'Explore > Discovery > Cloud Service Dashboard'. Which of the following scenarios best describes the technical activity associated with this technique?
While the host timeline is comprehensive, some data is not included in that specific view. Which of the following CANNOT be seen directly from the host timeline?
When using 'User Search' to investigate a potentially compromised account, which of the following is NOT a filter available in the User Search?
Host Search is a powerful investigation tool. From which of the following sources is a responder most likely to pivot directly to a Host Search?
In the Hash Search tool, which of the following is listed under Process Executions?
A responder needs to view a high-level overview of the environment's security posture. Where can they find the 'Activity Dashboard'?
To perform a deep-dive investigation into a specific detection, a responder needs to pivot to a process timeline. What is the minimum information required to be gathered from the detection before making this pivot?
An analyst is triaging a detection that has been categorized under the ‘Follow Through’ Objective Layer. Based on the Falcon technical documentation, which of the following adversary tactics is most likely to be observed within this specific layer?
Which tool or search type is recommended as the "best search" to use when performing the "Examine what's normal for this system" step in an investigation?
The Falcon console is divided into several modules. Timelines (Host and Process) are technically a part of which Falcon page?
Falcon uses specific identifiers to track processes across the environment. Which of the following sentences best describes what the 'TargetProcessId_decimal' raw data represents?
An analyst needs to perform local sandbox analysis on a malicious file. When they download a quarantined file from the Falcon UI, what is the file format and the default password?
From a detection, what is the fastest way to see children and sibling process information?
After pivoting to an event search from a detection, you locate the ProcessRollup2 event. Which two field values are you required to obtain to perform a Process Timeline search so you can determine what the process was doing?
Which of the following statements about the 'Detection Activity' report is FALSE?
Which of the following sentences best describes the primary objective of 'Real-time Analysis' within the Falcon platform?
An analyst notices a detection that has been automatically flagged with the 'New Activity' status. Which of the following statements best describes what this status indicates?
You receive an email from a third-party vendor that one of their services is compromised,thevendor names a specific IP address that the compromised service was using. Where would you input this indicator to find any activity related to this IP address?
When an analyst is trying to pinpoint the exact moment an endpoint came online after being shut down for the weekend, which timeline view is the best to use?
When analyzing the raw telemetry for a 'DNSRequest' event, which of the following raw data fields is available to the responder?
You notice that taskeng.exe is one of the processes involved in a detection. What activity should you investigate next?
When an organization needs to detect a specific behavior that is unique to their environment, they can create a Custom IOA. Which of the following is NOT required when configuring a custom IOA from scratch?
When analyzing an executable with a global prevalence of common; but you do not know what the executable is. what is the best course of action?
The Falcon platform will show a maximum of how many detections per day for a single Agent Identifier (AID)?
TESTED 02 May 2026