Question 6
When you configure and apply an IOA exclusion, what impact does it have on the host and what you see in the console?
- The process specified is not sent to the Falcon Sandbox for analysis
- The associated detection will be suppressed and the associated process would have been allowed to run
- The sensor will stop sending events from the process specified in the regex pattern
- The associated IOA will still generate a detection but the associated process would have been allowed to run
Question 7
What are Event Actions?
- Automated searches that can be used to pivot between related events and searches
- Pivotable hyperlinks available in a Host Search
- Custom event data queries bookmarked by the currently signed in Falcon user
- Raw Falcon event data
Question 8
Where are quarantined files stored on Windows hosts?
- Windows\Quarantine
- Windows\System32\Drivers\CrowdStrike\Quarantine
- Windows\System32\
- Windows\temp\Drivers\CrowdStrike\Quarantine
Question 9
How long does detection data remain in the CrowdStrike Cloud before purging begins?
- 90 Days
- 45 Days
- 30 Days
- 14 Days
Question 10
What is an advantage of using a Process Timeline?
- Process related events can be filtered to display specific event types
- Suspicious processes are color-coded based on their frequency and legitimacy over time
- Processes responsible for spikes in CPU performance are displayed over time
- A visual representation of Parent-Child and Sibling process relationships is provided