Q22. Which threat framework allows a threat hunter to explore and model specific adversary tactics and techniques, with links to intelligence and case studies?

Q23. The Events Data Dictionary found in the Falcon documentation is useful for writing hunting queries because:

Q24. You need details about key data fields and sensor events which you may expect to find from Hosts running the Falcon sensor. Which documentation should you access?

Q25. Which of the following queries will return the parent processes responsible for launching badprogram exe?

Q26. Which of the following is an example of actor actions during the RECONNAISSANCE phase of the Cyber Kill Chain?

Q27. You would like to search for ANY process execution that used a file stored in the Recycle Bin on a Windows host. Select the option to complete the following EAM query.

Q28. SPL (Splunk) eval statements can be used to convert Unix times (Epoch) into UTC readable time Which eval function is correct^

Q29. Event Search data is recorded with which time zone?

Q30. What elements are required to properly execute a Process Timeline?

Q31. SPL (Splunk) eval statements can be used to convert Unix times (Epoch) into UTC readable time Which eval function is correct^

Q32. You want to produce a list of all event occurrences along with selected fields such as the full path, time, username etc. Which command would be the appropriate choice?

Q33. To find events that are outliers inside a network,___________is the best hunting method to use.

Q34. What information is provided from the MITRE ATT&CK framework in a detection’s Execution Details?

Q35. Refer to Exhibit.

What type of attack would this process tree indicate?

Q36. What information is shown in Host Search?

Q37. With Custom Alerts you are able to configure email alerts using predefined templates so you’re notified about specific activity in your environment. Which of the following outlines the steps required to properly create a custom alert rule?

Q38. In which of the following stages of the Cyber Kill Chain does the actor not interact with the victim endpoint(s)?

Q39. Refer to Exhibit.

Falcon detected the above file attempting to execute. At initial glance; what indicators can we use to provide an initial analysis of the file?

Q40. Which of the following does the Hunting and Investigation Guide contain?

Q41. While you’re reviewing Unresolved Detections in the Host Search page, you notice the User Name column contains “hostnameS ” What does this User Name indicate?

Q42. What Search page would help a threat hunter differentiate testing, DevOPs, or general user activity from adversary behavior?

Q43. Which of the following is TRUE about a Hash Search?