Question 1

What do IOA exclusions help you achieve?

Options :

A : Reduce false positives based on Next-Gen Antivirus settings in the Prevention Policy

B : Reduce false positives of behavioral detections from IOA based detections only

C : Reduce false positives of behavioral detections from IOA based detections based on a file hash

D : Reduce false positives of behavioral detections from Custom IOA and OverWatch detections only

Answer: B

Question 2

You are reviewing the raw data in an event search from a detection tree. You find a FileOpenInfo event and want to find out if any other files were opened by the responsible process. Which two field values do you need from this event to perform a Process Timeline search?

Options :

A : ParentProcessId_decimal and aid

B : ResponsibleProcessId_decimal and aid

C : ContextProcessId_decimal and aid

D : TargetProcessId_decimal and aid

Answer: B

Question 3

The Falcon platform will show a maximum of how many detections per day for a single Agent Identifier (AID)?

Options :

A : 500

B : 750

C : 1000

D : 1200

Answer: C

Question 4

A list of managed and unmanaged neighbors for an endpoint can be found:

Options :

A : by using Hosts page in the Investigate tool

B : by reviewing "Groups" in Host Management under the Hosts page

C : under "Audit" by running Sensor Visibility Exclusions Audit

D : only by searching event data using Event Search

Answer: A

Question 5

From the Detections page, how can you view 'in-progress' detections assigned to Falcon Analyst Alex?

Options :

A : Filter on 'Analyst: Alex'

B : Alex does not have the correct role permissions as a Falcon Analyst to be assigned detections

C : Filter on 'Hostname: Alex' and 'Status: In-Progress'

D : Filter on 'Status: In-Progress' and 'Assigned-to: Alex

Answer: D