Question 1

SPL (Splunk) eval statements can be used to convert Unix times (Epoch) into UTC readable time Which eval function is correct^

Options :

A : now

B : typeof

C : strftime

D : relative time

Answer: C

Question 2

How do you rename fields while using transforming commands such as table, chart, and stats?

Options :

A : By renaming the fields with the "rename" command after the transforming command e.g. "stats count by ComputerName | rename count AS total_count"

B : You cannot rename fields as it would affect sub-queries and statistical analysis

C : By using the "renam

D : By specifying the desired name after the field name eg "stats count totalcount by ComputerName"

Answer: A

Question 3

What Investigate tool would you use to allow an analyst to view all events for a specific host?

Options :

A : Bulk Timeline

B : Host Search

C : Host Timeline

D : Process Timeline

Answer: C

Question 4

You need details about key data fields and sensor events which you may expect to find fromHosts running the Falcon sensor.Which documentation should you access?

Options :

A : Events Data Dictionary

B : Streaming API Event Dictionary

C : Hunting and Investigation

D : Event stream APIs

Answer: A

Question 5

Event Search data is recorded with which time zone?

Options :

A : PST

B : GMT

C : EST

D : UTC

Answer: D

Higher Test Marks with Free Online CCFH-202b Exam Practice

Buying Options: