CCFR-201b 무료 덤프문제 온라인 액세스

When reviewing open detections, what method should be used to identify the most relevant related information in the environment?

• A.Grouping detections by command line, host, hash, or triggering file
• B.Host Management grouping by host, organizational unit, or prevention policy
• C.Review the Detection Resolutions dashboard
• D.Sort detections by Time: Oldest to Newest

When a responder is looking at the ' Full Detection Details ' page, they can toggle between several views.
Which of the following is NOT a layout option available for viewing these details?

• A.Process Timeline
• B.Graph View
• C.List View
• D.Tree View

Which statement is TRUE regarding the " Bulk Domains " search?

• A.The " Bulk Domains " search will allow you to blocklist your queried domains
• B.The " Bulk Domains " search will show IP address and port information for any associated connections
• C.You should only pivot to the " Bulk Domains " search tool after completing an investigation
• D.It will show a list of computers and process that performed a lookup of any of the domains in your search

When examining a raw DNS request event, you see a field called ContextProcessld_decimal. What is the purpose of that field?

• A.It contains an internal value not useful for an investigation
• B.It contains the TargetProcessld_decimal value for the process that made the DNS request
• C.It contains the TargetProcessld_decimal value for other related events
• D.It contains the ContextProcessld_decimal value for the parent process that made the DNS request

Responders often use Process Explorer to visualize process behavior. Which of the following is NOT a valid way to pivot to a Process Explorer view?

• A.From Configuration > Prevention Policies > View Process Explorer
• B.From Detection > Top Right Drop Down > View as Process Activity
• C.From Host Search > Processes and Services list
• D.From Event Search > Click on a specific Process ID