CCFR-201 試験問題を無料オンラインアクセス

Aside from a Process Timeline or Event Search, how do you export process event data from a detection in
.CSV format?

• A.From the Detections Dashboard, you right-click the event type you wish to export and choose CSV.JSON or XML
• B.In Full Detection Details, you choose the "View Process Activity" option and then export from that view
• C.In Full Detection Details, you expand the nodes of the process tree you wish to expand and then click the "Export Process Events" button
• D.You can't export detailed event data from a detection, you have to use the Process Timeline or an Event Search

When looking at the details of a detection, there are two fields called Global Prevalence and Local Prevalence.
Which answer best defines Local Prevalence?

• A.Local Prevalence is the Virus Total score for the hash of the triggering file
• B.Local prevalence is the frequency with which the hash of the triggering file is seen across all CrowdStrike customer environments
• C.Local prevalence is the frequency with which the hash of the triggering file is seen across the entire Internet
• D.Local Prevalence tells you how common the hash of the triggering file is within your environment (CID)

How long are quarantined files stored on the host?

• A.Quarantined files are never deleted from the host
• B.30 Days
• C.90 Days
• D.45 Days

Which is TRUE regarding a file released from quarantine?

• A.It is allowed to execute on all hosts
• B.It is deleted
• C.No executions are allowed for 14 days after release
• D.It will not generate future machine learning detections on the associated host

The Process Activity View provides a rows-and-columns style view of the events generated in a detection.
Why might this be helpful?

• A.The Process Activity View creates a count of event types only, which can be useful when scoping the event
• B.The Process Activity View will show the Detection time of the earliest recorded activity which might indicate first affected machine
• C.The Process Activity View creates a consolidated view of all detection events for that process that can be exported for further analysis
• D.The Process Activity View only creates a summary of Dynamic Link Libraries (DLLs) loaded by a process