최신CrowdStrike Certified Falcon Responder - CCFR-201무료샘플문제

A. Falcon X

B. Discover

C. Spotlight

D. Investigate

A. The hash is submitted for approval to be allowed to execute once confirmed by Falcon specialists

B. Execution is prevented, but detection alerts are suppressed

C. Execution is allowed on all hosts that fall under the organization's CID

D. Execution is allowed on all hosts, including all other Falcon customers

A. A visual representation of Parent-Child and Sibling process relationships is provided

B. Processes responsible for spikes in CPU performance are displayed overtime

C. Suspicious processes are color-coded based on their frequency and legitimacy over time

D. Process related events can be filtered to display specific event types

A. StartofProcess

B. EndofProcess

C. DnsRequest

D. ProcessRollup2

A. Execution is prevented on selected host groups

B. Execution is prevented on all hosts by default

C. The hash is submitted for approval to be blocked from execution once confirmed by Falcon specialists

D. Execution is prevented and detection alerts are suppressed

A. The Process Activity View creates a consolidated view of all detection events for that process that can be exported for further analysis

B. The Process Activity View will show the Detection time of the earliest recorded activity which might indicate first affected machine

C. The Process Activity View creates a count of event types only, which can be useful when scoping the event

D. The Process Activity View only creates a summary of Dynamic Link Libraries (DLLs) loaded by a process

A. UTCtime

B. ProcessTimeline Link

C. Process ID or Parent Process ID

D. PID