EMT Practice Test

1. Question Content...

---

Question1: Which of the following is an example of a MITRE ATT&CK tactic?

Question2: Where can you find hosts that are in Reduced Functionality Mode?

Question3: You receive an email from a third-party vendor that one of their services is compromised,thevendor names a specific IP address that the compromised service was using. Where would you input this indicator to find any activity related to this IP address?

Question4: Which is TRUE regarding a file released from quarantine?

Question5: Which of the following is NOT a filter available on the Detections page?

Question6: What does the Full Detection Details option provide?

Question7: From a detection, what is the fastest way to see children and sibling process information?

Question8: Within the MITRE-Based Falcon Detections Framework, what is the correct way to interpret Keep Access > Persistence > Create Account?

Question9: What is the difference between a Host Search and a Host Timeline?

Question10: When analyzing an executable with a global prevalence of common; but you do not know what the executable is. what is the best course of action?

Question11: In the Hash Search tool, which of the following is listed under Process Executions?

Question12: Which option indicates a hash is allowlisted?

Question13: After running an Event Search, you can select many Event Actions depending on your results. Which of the following is NOT an option for any Event Action?

Question14: Which statement is TRUE regarding the "Bulk Domains" search?

Question15: Aside from a Process Timeline or Event Search, how do you export process event data from a detection in
.CSV format?

Question16: Which of the following is NOT a valid event type?

Question17: How long are quarantined files stored on the host?

Question18: What happens when you create a Sensor Visibility Exclusion for a trusted file path?

Question19: How long does detection data remain in the CrowdStrike Cloud before purging begins?

Question20: How long are quarantined files stored in the CrowdStrike Cloud?

Question21: What action is used when you want to save a prevention hash for later use?

Question22: What types of events are returned by a Process Timeline?

Question23: Where are quarantined files stored on Windows hosts?

Question24: What action is used when you want to save a prevention hash for later use?

Question25: What happens when a quarantined file is released?

Question26: From the Detections page, how can you view 'in-progress' detections assigned to Falcon Analyst Alex?

Question27: What happens when a hash is allowlisted?

Question28: What is the difference between Managed and Unmanaged Neighbors in the Falcon console?