3.2 Differentiate Use of Investigate Module Tools Available in Falcon CCFH Practice Questions (Page 6)

Questions 26–29

1. 26foundation · easy

   In the Falcon Investigate module, how can an analyst access the details of a specific detection?

   • ABy using the API to download the sensor's configuration file
   • BBy running a pre-configured report from the Reports tab
   • CBy sending a request to Falcon support
   • DBy clicking on the detection in the detections list or search results
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which of the following is an example of an entity that can be explored in Falcon Investigate?

   • AA Falcon sensor update package
   • BA network firewall rule
   • CA CrowdStrike support ticket
   • DA specific user account
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   In the Falcon Investigate graph view, what do the nodes typically represent?

   • AIndividual events in chronological order
   • BNetwork IP addresses only
   • CFalcon sensor versions
   • DEntities such as hosts, users, and files
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security team regularly investigates detections involving a specific type of malware. They want to create a reusable query that they can run daily to find new detections of this malware and share the results with the team. Which Investigate module feature should they use?

   • AUse the graph view to search for the malware and save the graph as an image.
   • BCreate a saved search for the malware indicator and schedule it to run daily.
   • CCreate a report of all detections and export it to a PDF for the team.
   • DUse the search bar to query for the malware indicator each time and manually note the results.
   Reveal Solution Discussion Select an answer first