Question 1

Where can you find hosts that are in Reduced Functionality Mode?

Options :

A : Event Search

B : Executive Summary dashboard

C : Host Search

D : Installation Tokens

Answer: C

Question 2

Which Executive Summary dashboard item indicates sensors running with unsupported versions?

Options :

A : Detections by Severity

B : Inactive Sensors

C : Sensors in RFM

D : Active Sensors

Answer: C

Question 3

What action is used when you want to save a prevention hash for later use?

Options :

A : Always Block

B : Never Block

C : Always Allow

D : No Action

Answer: A

Question 4

What action is used when you want to save a prevention hash for later use?

Options :

A : Always Block

B : Never Block

C : Always Allow

D : No Action

Answer: A

Question 5

You notice that taskeng.exe is one of the processes involved in a detection. What activity should you investigate next?

Options :

A : User logons after the detection

B : Executions of schtasks.exe after the detection

C : Scheduled tasks registered prior to the detection

D : Pivot to a Hash search for taskeng.exe

Answer: C

Free CCFR-201b Mock Exam – Practice Online Confidently