Question 1

You notice that taskeng.exe is one of the processes involved in a detection. What activity should you investigate next?

AUser logons after the detection

BExecutions of schtasks.exe after the detection

CScheduled tasks registered prior to the detection

DPivot to a Hash search for taskeng.exe

Answer : C

According to the [Microsoft website], taskeng.exe is a legitimate Windows process that is responsible for running scheduled tasks. However, some malware may use this process or create a fake one to execute malicious code. Therefore, if you notice taskeng.exe involved in a detection, you should investigate whether there are any scheduled tasks registered prior to the detection that may have triggered or injected into taskeng.exe. You can use tools such as schtasks.exe or Task Scheduler to view or manage scheduled tasks.

Question 2

Where can you find hosts that are in Reduced Functionality Mode?

AEvent Search

BExecutive Summary dashboard

CHost Search

DInstallation Tokens

Answer : C

According to theCrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, Reduced Functionality Mode (RFM) is a state where a host's sensor has limited functionality due to various reasons, such as license expiration, network issues, tampering attempts, etc1.You can find hosts that are in RFM by using the Host Search tool and filtering by Sensor Status = RFM1.You can also view details about why a host is in RFM by clicking on its hostname1.

Question 3

When reviewing a Host Timeline, which of the following filters is available?

ASeverity

BEvent Types

CUser Name

DDetection ID

Answer : B

According to theCrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Host Timeline tool allows you to view all events recorded by the sensor for a given host in a chronological order1.The events include process executions, file writes, registry modifications, network connections, user logins, etc1.You can use various filters to narrow down the events based on criteria such as event type, timestamp range, file name, registry key, network destination, etc1.However, there is no filter for severity, user name, or detection ID, as these are not attributes of the events1.

Question 4

In the "Full Detection Details", which view will provide an exportable text listing of events like DNS requests. Registry Operations, and Network Operations?

AThe data is unable to be exported

BView as Process Tree

CView as Process Timeline

DView as Process Activity

Answer : D

According to theCrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Full Detection Details tool allows you to view detailed information about a detection, such as detection ID, severity, tactic, technique, description, etc1.You can also view the events generated by the processes involved in the detection in different ways, such as process tree, process timeline, or process activity1.The process activity view provides a rows-and-columns style view of the events, such as DNS requests, registry operations, network operations, etc1.You can also export this view to a CSV file for further analysis1.

Question 5

When looking at the details of a detection, there are two fields called Global Prevalence and Local Prevalence. Which answer best defines Local Prevalence?

ALocal prevalence is the frequency with which the hash of the triggering file is seen across the entire Internet

BLocal Prevalence tells you how common the hash of the triggering file is within your environment (CID)

CLocal Prevalence is the Virus Total score for the hash of the triggering file

DLocal prevalence is the frequency with which the hash of the triggering file is seen across all CrowdStrike customer environments