On a Windows host, what is the best command to determine if the sensor is currently running?

• A.sc query csagent
• B.netstat -a
• C.This cannot be accomplished with a command
• D.ping falcon.crowdstrike.com

Comment: *

Name: *

Email: *

Verification: *

Which of the following roles allows a Falcon user to create Real Time Response Custom Scripts?

• A.Real Time Responder - Administrator
• B.Real Time Responder - Script Developer
• C.Real Time Responder - Active Responder
• D.Real Time Responder - Read Only Analyst

Comment: *

Name: *

Email: *

Verification: *

You have an existing workflow that is triggered on a critical detection that sends an email to the escalation team. Your CISO has asked to also be notified via email with a customized message. What is the best way to update the workflow?

• A.Clone the workflow and replace the existing email with your CISO's email
• B.Add a sequential action to send a custom email to your CISO
• C.Add a parallel action to send a custom email to your CISO
• D.Add the CISO's email to the existing action

Comment: *

Name: *

Email: *

Verification: *

What will happen to a host if it is not assigned a Sensor Update policy?

• A.The host will uninstall the Sensor and provide an alert to the installation team
• B.The host will automatically update to the newest sensor version and auto-update to future release
• C.The host will automatically create a custom Sensor Update policy
• D.The host will use the Default Sensor Update policy

Comment: *

Name: *

Email: *

Verification: *

Your CISO has decided all Falcon Analysts should also have the ability to view files and file contents locally on compromised hosts, but without the ability to take them off the host. What is the most appropriate role that can be added to fullfil this requirement?

• A.Remediation Manager
• B.Real Time Responder - Read Only Analyst
• C.Falcon Analyst - Read Only
• D.Real Time Responder - Active Responder

Comment: *

Name: *

Email: *

Verification: *