3.2 Differentiate Use of Investigate Module Tools Available in Falcon CCFH Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In CrowdStrike Falcon, what is the primary purpose of the Investigate module?

   • ATo generate executive-level compliance reports for regulatory audits
   • BTo automate response actions such as isolating hosts and blocking indicators
   • CTo configure and manage Falcon sensor deployment policies across the organization
   • DTo perform threat hunting and in-depth analysis of events, detections, and entities within the environment
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is an example of a collaboration tool available in Falcon Investigate?

   • APosting findings to a public social media platform
   • BSharing a link to a detection or investigation with another analyst
   • CSending a direct message to the CrowdStrike support team
   • DCreating a ticket in an external IT service management system
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which Falcon module would a security analyst use to pivot from a detection to related events and entities for deeper investigation?

   • AFalcon Fusion
   • BDetections
   • CInvestigate
   • DReal-time Response
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security analyst is investigating a suspicious PowerShell command that executed on a single host. The analyst knows the hostname and the approximate time of execution but wants to see all events on that host within a 10-minute window around the execution, including any parent and child processes. Which approach in the Investigate module should the analyst use first?

   • ANavigate to the host entity page and click on the 'Processes' tab to see all running processes.
   • BUse the graph view to search for the host and expand all connected entities.
   • COpen the detection details for the PowerShell alert and review the event timeline.
   • DUse the search bar to query for the hostname and time range, then apply a process name filter for PowerShell.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the purpose of the export functionality in Falcon Investigate?

   • ATo synchronize Falcon data with a local SIEM in real time
   • BTo delete old events from the Falcon cloud
   • CTo download investigation data for external analysis or reporting
   • DTo upload new detection rules to the Falcon platform
   Reveal Solution Discussion Select an answer first