CrowdStrike Certified Falcon Hunter v1.0

In the MITRE ATT&CK Framework (version 11 - the newest version released in April 2022), which of the following pair of tactics is not in the Enterprise: Windows matrix?

In which of the following stages of the Cyber Kill Chain does the actor not interact with the victim endpoint(s)?

What information is provided from the MITRE ATT&CK framework in a detection's Execution Details?

You need details about key data fields and sensor events which you may expect to find from Hosts running the Falcon sensor. Which documentation should you access?

The Events Data Dictionary found in the Falcon documentation is useful for writing hunting queries because:

Which Falcon documentation guide should you reference to hunt for anomalies related to scheduled tasks and other Windows related artifacts?

What topics are presented in the Hunting and Investigation Guide?

Which of the following does the Hunting and Investigation Guide contain?

Which document provides information on best practices for writing Splunk-based hunting queries, predefined queries which may be customized to hunt for suspicious network connections, and predefined queries which may be customized to hunt for suspicious processes?

What is the main purpose of the Mac Sensor report?

Where would an analyst find information about shells spawned by root, Kernel Module loads, and wget/curl usage?

Which of the following best describes the purpose of the Mac Sensor report?

In the Powershell Hunt report, what does the “score” signify?

In the Powershell Hunt report, what does the filtering condition of CommandLine!="*badstring*" do?