The Process Activity View provides a rows-and-columns style view of the events generated in a detection.
Why might this be helpful?

• A. The Process Activity View will show the Detection time of the earliest recorded activity which might indicate first affected machine
• B. The Process Activity View creates a consolidated view of all detection events for that process that can be exported for further analysis
• C. The Process Activity View only creates a summary of Dynamic Link Libraries (DLLs) loaded by a process
• D. The Process Activity View creates a count of event types only, which can be useful when scoping the event

Multiple detections with the process schtasks.exe begin to alert in the UI. The process executes the following command line on several unique hosts:
schtasks.exe /Query /TN " Qljsscdqr "
What is the most efficient way to identify which hosts are executing this scheduled task?

• A. Filter detections by command line and group by triggering file
• B. Filter detections by command line and sort by ' Host:A to Z '
• C. Filter detections by command line and group by host
• D. Filter detections by the triggering file and sort by ' Host:A to Z '

When a responder is looking at the ' Full Detection Details ' page, they can toggle between several views.
Which of the following is NOT a layout option available for viewing these details?

• A. Process Timeline
• B. List View
• C. Graph View
• D. Tree View

A security responder is investigating a detection where a low-privileged process attempted to manipulate a system token to gain administrative rights. Within the specific terminology used by the Falcon console, ' Privilege Escalation ' is classified as a:

• A. Technique
• B. Indicator
• C. Tactic
• D. Objective

What action is used when you want to save a prevention hash for later use?

• A. Always Allow
• B. Never Block
• C. No Action
• D. Always Block