NEW QUESTION 35
To find events that are outliers inside a network,___________is the best hunting method to use.

NEW QUESTION 36
Lateral movement through a victim environment is an example of which stage of the Cyber Kill Chain?

NEW QUESTION 37
Which of the following is an example of a Falcon threat hunting lead?

NEW QUESTION 38
Which of the following is an example of actor actions during the RECONNAISSANCE phase of the Cyber Kill Chain?

NEW QUESTION 39
SPL (Splunk) eval statements can be used to convert Unix times (Epoch) into UTC readable time Which eval function is correct^

NEW QUESTION 40
Which tool allows a threat hunter to populate and colorize all known adversary techniques in a single view?

NEW QUESTION 41
You are reviewing a list of domains recently banned by your organization’s acceptable use policy. In particular, you are looking for the number of hosts that have visited each domain. Which tool should you use in Falcon?

NEW QUESTION 42
In the MITRE ATT&CK Framework (version 11 – the newest version released in April 2022), which of the following pair of tactics is not in the Enterprise: Windows matrix?

NEW QUESTION 43
Which of the following is the proper method to quantify search results, enabling a hunter to quickly sort and identify outliers?

NEW QUESTION 44
What Investigate tool would you use to allow an analyst to view all events for a specific host?

NEW QUESTION 45
Which of the following is a suspicious process behavior?

NEW QUESTION 46
What topics are presented in the Hunting and Investigation Guide?

NEW QUESTION 47
Which of the following is a recommended technique to find unique outliers among a set of data in the Falcon Event Search?

NEW QUESTION 48
Which document provides information on best practices for writing Splunk-based hunting queries, predefined queries which may be customized to hunt for suspicious network connections, and predefined queries which may be customized to hunt for suspicious processes?

NEW QUESTION 49
What information is provided when using IP Search to look up an IP address?

NEW QUESTION 50
Where would an analyst find information about shells spawned by root, Kernel Module loads, and wget/curl usage?

NEW QUESTION 51
What information is provided from the MITRE ATT&CK framework in a detection’s Execution Details?

NEW QUESTION 52
Which of the following is TRUE about a Hash Search?

NEW QUESTION 53
To view Files Written to Removable Media within a specified timeframe on a host within the Host Search page, expand and refer to the _______dashboard panel.

NEW QUESTION 54
In which of the following stages of the Cyber Kill Chain does the actor not interact with the victim endpoint(s)?

NEW QUESTION 55
Which Falcon documentation guide should you reference to hunt for anomalies related to scheduled tasks and other Windows related artifacts?

NEW QUESTION 56
Which of the following does the Hunting and Investigation Guide contain?

NEW QUESTION 57
A benefit of using a threat hunting framework is that it:

NEW QUESTION 58
With Custom Alerts you are able to configure email alerts using predefined templates so you’re notified about specific activity in your environment. Which of the following outlines the steps required to properly create a custom alert rule?