dumpstool logo
You are reviewing the raw data in an event search from a detection tree. You find a FileOpenlnfo event and want to find out if any other files were opened by the responsible process. Which two field values do you need from this event to perform a Process Timeline search?
Analyze the following process lineage observed during a detection triage on a Windows 10 workstation:
root > smss.exe > winlogon.exe > userinit.exe > explorer.exe > windows_media_player_y35s21-4ak.exe.
Based on the fact that the suspicious process originated from the user ' s desktop shell environment (explorer.exe), what is the most likely entry vector for this attack?
The Falcon platform will show a maximum of how many detections per day for a single Agent Identifier (AID)?
Depending on the subscription level, " Cloudable Events " (standard telemetry) have a specific retention period. What is the minimum period of time that these events are retained?
The Falcon console is divided into several modules. Timelines (Host and Process) are technically a part of which Falcon page?
The Process Activity View provides a rows-and-columns style view of the events generated in a detection. Why might this be helpful?
In the Falcon Overwatch Best Practice workflow, at what specific point is a responder encouraged to utilize OSINT (Open Source Intelligence) searches?
While examining the ' Process Details ' sidebar of a detection, a responder sees the following icons: " 25 Network Operations " and " 277 Disk Operations " . What does this contextual data represent?
When investigating system-level persistence, it is critical to know what the services.exe process is responsible for. What is its primary function?
An analyst needs to perform local sandbox analysis on a malicious file. When they download a quarantined file from the Falcon UI, what is the file format and the default password?
While quarantined files stay on the local host for 30 days by default, how many days does a quarantined file remain stored in the CrowdStrike Cloud?
Which Executive Summary dashboard item indicates sensors running with unsupported versions?
When managing files within the ' Quarantined Files ' dashboard, which of the following is NOT a valid action available to the responder?
A responder releases a file from quarantine on a specific workstation. What is the default scope of the allowlist that is created during this process?
When navigating the ' Custom IOA ' creation wizard, a user must select a rule type. Which of the following is NOT a valid IOA rule type available for selection?
While investigating a detection, you pivot to the Advanced Event Search.
Which field would you filter by to return events executing from a specific directory on the host?
A responder is using ' Host Search ' to gather baseline data on a machine. Which of the following pieces of information is NOT provided by the Host Search results?
When analyzing an executable with a global prevalence of common; but you do not know what the executable is. what is the best course of action?
What is the difference between Managed and Unmanaged Neighbors in the Falcon console?
To track the relationship between a parent and its child, Falcon uses specific ID fields. What raw data is used as the ' ParentProcessId_decimal ' when a process spawns a child process?
When viewing the summary list on the ' Endpoint Detections ' page, an analyst sees a column for the timestamp. What does the timestamp in this specific summary view represent?
A responder is analyzing a MITRE-related alert and sees the technique ' Explore > Discovery > Cloud Service Dashboard ' . Which of the following scenarios best describes the technical activity associated with this technique?
In the ' Graph View ' of a detection, processes are connected by arrows. Which of the following does a yellow arrow connecting two processes indicate?
If a local administrator needs to inspect the quarantine directory directly on a machine, where are quarantine files located on a Windows Endpoint?
Which of the following subtitles/sub-views cannot be seen in the results of a ' Hash Search ' ?
An attacker attaches cmd.exe as a debugger to osk.exe through a registry key.
What tactic and technique describe this activity?
When reviewing CrowdScore Incidents, which of the following statements is INCORRECT?
Which of the following sentences best describes the technical visibility provided by the ' Host Timeline ' view?
An analyst needs to quickly view the activity surrounding a suspicious process. Which of the following sequences of steps will pivot to an auto-filled process timeline in the Falcon UI?
When an analyst is trying to pinpoint the exact moment an endpoint came online after being shut down for the weekend, which timeline view is the best to use?
When using ' User Search ' to investigate a potentially compromised account, which of the following is NOT a filter available in the User Search?
CrowdStrike provides ' Overwatch Best Practices ' for triaging alerts. According to these guidelines, what is the next step a responder should take immediately after the ' Understand the detection ' step?
A responder is analyzing a file ' s prevalence. If the data shows ' Local: High ' and ' Global: Unique ' , which of the following is the most likely conclusion?
You found a list of SHA256 hashes in an intelligence report and search for them using the Hash Execution Search. What can be determined from the results?
A responder is focused on a specific malicious script and wants to see everything that the script ' s process did. Which timeline is the best tool for this task?
Which of the following sentences best describes the primary objective of ' Real-time Analysis ' within the Falcon platform?
A responder is explaining the quarantine process to a system administrator. What happens technically when a file is quarantined by the Falcon sensor?
After running an Event Search, you can select many Event Actions depending on your results. Which of the following is NOT an option for any Event Action?
The User Search results are organized into several categories. Which of the following is NOT a sub-heading in the User Search?
After an investigation, the following malicious artifacts have been identified:
C:\Users*\AppData\iamnotmalware.exe
C:\Users*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iamnotmalware.lnk
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iamnotmalware_really
What method will remove all associated artifacts from hosts that trigger future related detections?
Filtering is essential for managing a high volume of alerts. Which of the following filters is available by default within the ' Endpoint Detections ' dashboard to help narrow down specific threats?
Responders must understand the limitations and capabilities of custom rules. Which of the following statements about custom IOAs is FALSE?
You have a folder with the path C:\Windows\BadTools.
Using native Real Time Response (RTR) commands, what is the correct syntax to remove the folder and all of its contents?
Refer to the image.
You receive the detection displayed in the image above on a host in your environment.
Assuming you have the correct permissions, where would you navigate to remotely connect to the host and investigate further?
Executive dashboards provide a high-level view of security. Which of the following CANNOT be seen from the Executive Summary Dashboard?
During the incident response process, a responder must update the status of a detection. Which of the following options is NOT a valid detection status recognized by the Falcon console?
An executive asks for a definition of ' CrowdScore ' . Which of the following sentences best describes what CrowdScore is?
You are concerned that a compromised user may have run multiple malicious commands across multiple hosts.
What information from Investigate > Search > Users will help you quickly find evidence of this behavior?
During the configuration of a new IOA rule, the administrator must decide what action the sensor should take. Which of the following is NOT a valid IOA rule action?
TESTED 18 Aug 2026
