Question 1

You notice that taskeng.exe is one of the processes involved in a detection. What activity should you investigate next?

Options :

A : User logons after the detection

B : Executions of schtasks.exe after the detection

C : Scheduled tasks registered prior to the detection

D : Pivot to a Hash search for taskeng.exe

Answer: C

Question 2

A list of managed and unmanaged neighbors for an endpoint can be found:

Options :

A : by using Hosts page in the Investigate tool

B : by reviewing "Groups" in Host Management under the Hosts page

C : under "Audit" by running Sensor Visibility Exclusions Audit

D : only by searching event data using Event Search

Answer: A

Question 3

From a detection, what is the fastest way to see children and sibling process information?

Options :

A :

Select the Event Search option. Then from the Event Actions, select Show Associated Event Data (From TargetProcessId_decimal)

B : Select Full Detection Details from the detection

C : Right-click the process and select "Follow Process Chain"

D : Select the Process Timeline feature, enter the AID, Target Process ID, and Parent Process ID

Answer: C

Question 4

What action is used when you want to save a prevention hash for later use?

Options :

A : Always Block

B : Never Block

C : Always Allow

D : No Action

Answer: A

Question 5

Which Executive Summary dashboard item indicates sensors running with unsupported versions?

Options :

A : Detections by Severity

B : Inactive Sensors

C : Sensors in RFM

D : Active Sensors

Answer: C

Higher Test Marks with Free Online CCFR-201b Exam Practice