7.4 Construct Simple and Complex EAM Queries in Falcon CCFH Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   To improve the performance of an EAM query that searches for a specific process name, which field should be used in the filter to take advantage of indexing?

   • AFileName
   • Btimestamp
   • Cevent_platform
   • DCommandLine
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   In an Event Search (EAM) query, which operator is used to match a field value that contains a specific substring?

   • A=
   • B>
   • C=*
   • D!=
   Reveal Solution Discussion Select an answer first
4. 3foundation · medium

   Which characteristic is most indicative of a complex Event Audit Management (EAM) query, as opposed to a simple query?

   • AIt uses nested expressions and logical operators such as AND and OR to combine multiple conditions.
   • BIt uses a wildcard pattern to match any value in a field.
   • CIt retrieves results from multiple event types in a single query.
   • DIt filters on a single field with one equality condition.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security analyst needs to quickly identify all processes that were created by PowerShell on a specific host to investigate a potential script-based attack. The host's device ID is 'abc123'. Which EAM query is the most efficient for this task?

   • Aevent_simpleName=ProcessRollup2 ComputerName=abc123
   • BFileName=PowerShell.exe aid=abc123
   • Cevent_simpleName=ProcessRollup2 aid=abc123 FileName=PowerShell.exe
   • Devent_simpleName=ProcessRollup2 FileName=PowerShell.exe
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   When optimizing an EAM query, which field is most appropriate to filter on to reduce the result set to only events from a specific host?

   • Auser_name
   • BCommandLine
   • Cevent_type
   • Daid
   Reveal Solution Discussion Select an answer first