5.3 Leverage the Events Reference (Events Data Dictionary) Documentation to Learn Information About Specific Events CCFH Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In the Events Reference, the field 'CommandLine' for a process event is listed. What type of information does this field typically contain?

   • AThe name of the user who launched the process.
   • BThe hash of the executable file associated with the process.
   • CThe full command line used to launch the process, including arguments.
   • DThe path to the executable file on disk.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the primary purpose of the Events Reference (Events Data Dictionary) in the Falcon platform?

   • ATo provide a searchable repository of documentation about event types, including their purpose and field definitions.
   • BTo store raw event logs for compliance and retention purposes.
   • CTo provide a real-time feed of all events generated across the organization.
   • DTo allow administrators to configure which events are collected and stored.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   An analyst needs to find documentation for the event type 'ProcessRollup2' in the Events Reference. What is the most direct way to locate this documentation?

   • ABrowse the Falcon console's 'All Events' list and click on the event name.
   • BNavigate to the Falcon Support portal and download the 'Event Types' PDF.
   • CUse the search bar in the Events Reference and type 'ProcessRollup2'.
   • DOpen the Falcon Sandbox and search for 'ProcessRollup2'.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   A security analyst is investigating a suspicious process event and wants to understand what the event means and what fields it contains. Which Falcon platform resource should the analyst use?

   • AThe Event Viewer on the host's detail page
   • BThe Falcon Sandbox report for the process
   • CThe Events Reference in the Falcon console
   • DThe Falcon Complete portal
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   While analyzing a detection, a Falcon Hunter sees an event with a field 'TargetFileName' and wants to know if it contains the full path or just the file name. What should they do to confirm this?

   • ACheck the host's file system to see the actual file path.
   • BRun the event through the Falcon Sandbox to see the file's behavior.
   • CLook at the event's severity to infer the field's importance.
   • DConsult the Events Reference for the event to read the field description.
   Reveal Solution Discussion Select an answer first