A Falcon administrator is investigating an incident that occurred on a specific date, but the Host Timeline is currently showing events from the last 24 hours. The administrator needs to navigate to the exact date and time of the incident. Which action should the administrator take?

Refresh the page to reset the timeline to the default view

Use the time picker to select the specific date and time range

Scroll back through the timeline until reaching the desired date

Use the search bar to type the date and time

A Falcon administrator is investigating a server that was reported to be down. The Host Timeline shows a 'Host Offline' event at 05:00 and a 'Host Online' event at 05:15. The administrator also sees a 'Kernel Panic' event at 05:00. The administrator needs to determine the most likely cause of the downtime. Which interpretation is most accurate?

The host experienced a network outage

The host was isolated by the network

The host was powered off and then powered on

The host was rebooted due to a kernel panic

CrowdStrikeCertified Falcon Hunter (CCFH)

Domain 2Objective 1

2.1 Analyze Information Displayed in the Host Timeline to Understand Host States and Events CCFH Practice Questions (Page 5)

Part of the Detection Analysis domain, which makes up ~10% of our current practice bank.

22questions here

5free pages

7concepts

Questions 21–22

21application · medium
A Falcon administrator is investigating an incident that occurred on a specific date, but the Host Timeline is currently showing events from the last 24 hours. The administrator needs to navigate to the exact date and time of the incident. Which action should the administrator take?
Select an answer first
22expert · hard
A Falcon administrator is investigating a server that was reported to be down. The Host Timeline shows a 'Host Offline' event at 05:00 and a 'Host Online' event at 05:15. The administrator also sees a 'Kernel Panic' event at 05:00. The administrator needs to determine the most likely cause of the downtime. Which interpretation is most accurate?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CCFH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFH” is a trademark of its owner, used for identification only.

2.1 Analyze Information Displayed in the Host Timeline to Understand Host States and Events CCFH Practice Questions (Page 5)

Questions 21–22

A Falcon administrator is investigating an incident that occurred on a specific date, but the Host Timeline is currently showing events from the last 24 hours. The administrator needs to navigate to the exact date and time of the incident. Which action should the administrator take?

Keep studying — Detection Analysis