MENU
After running an Event Search, you can select many Event Actions depending on your results. Which of the following is NOT an option for any Event Action?
Suggested Answer: A
Get Premium CCFR-201b Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
According to theCrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Event Search tool allows you to search for events based on various criteria, such as event type, timestamp, hostname, IP address, etc1.You can also select one or more events and perform various actions, such as show a process timeline, show a host timeline, show associated event data, show a +/- 10-minute window of events, etc1.However, there is no option to draw a process explorer, which is a graphical representation of the process hierarchy and activity1.
30 comments · newest first
ST
Stephaine
2 months ago
Good point! I feel more confident now.
TO
Tonette
2 months ago
Exactly, A is not an event action.
JE
Jesusita
3 months ago
Right! The others relate to event data.
MI
Micaela
3 months ago
Process Explorer doesn't fit with events.
ST
Stephaine
3 months ago
A seems like the odd one out.
TO
Tonette
3 months ago
I lean towards A.
JE
Jesusita
3 months ago
Yeah, I feel confused about the options.
MI
Micaela
3 months ago
I think it's tricky.
ZO
Zona
5 months ago
I thought all of these were possible, but I guess not!
IN
Ines
5 months ago
I agree, D doesn't sound like an option.
ME
Melissia
5 months ago
Wait, are you sure about B? Seems off.
SA
Salena
5 months ago
Definitely not A, that one's legit!
ME
Melynda
6 months ago
I think D is the right answer.
AL
Aliza
6 months ago
Hmm, I'm not sure about this one. Maybe B) Show a +/- 10-minute window of events? That could be a handy feature.
CA
Carli
6 months ago
I'm going with C) Show a Process Timeline for the responsible process. That seems like the most useful Event Action to me.
AD
Adela
6 months ago
Haha, I bet the correct answer is A) Draw Process Explorer. That sounds like something a developer would wish for, but it's definitely not a real option.
SH
Shawnee
6 months ago
D) Show Associated Event Data seems like the most logical choice here. The other options are all valid Event Actions.
MI
Mitsue
6 months ago
I think the answer is A) Draw Process Explorer, since that's not an actual Event Action option.
NO
Norah
7 months ago
I’m pretty sure that showing a Process Timeline is definitely an option, but I can't remember if all of these are valid actions.
PH
Phillip
7 months ago
I’m a bit confused about the "Show Associated Event Data" option. It sounds familiar, but I can't recall if it's standard for Event Actions.
SH
Sherrell
8 months ago
I feel like I've seen a question similar to this in practice, and I think "Draw Process Explorer" is a common action.
TE
Teri
8 months ago
I think I remember that the Event Actions usually include options to visualize processes, but I'm not sure about the +/- 10-minute window.
SH
Sherly
8 months ago
Ah, I see what they're getting at. I'll make sure to eliminate the options that are valid Event Actions.
BR
Brittni
8 months ago
I'm pretty confident I know the answer, but I want to double-check my understanding before submitting.
XE
Xenia
8 months ago
Okay, let me see... I think the key is to focus on which of these is not an option for any Event Action.
MA
Mayra
8 months ago
I'm a bit confused on the difference between some of these options. I'll have to review the details.
EA
Earnestine
9 months ago
Hmm, this one seems tricky. I'll need to think through the different Event Actions carefully.
NO
Noah
2 months ago
I agree with Lawrence. B feels off to me too.
HO
Hoa
2 months ago
I’m leaning towards A. Draw Process Explorer doesn’t sound right.
LA
Lawrence
2 months ago
I think it's B. The time window seems too specific.