CCFR-201b practice question 2 of 10
From the Detections page, how can you view 'in-progress' detections assigned to Falcon Analyst Alex?
Full set: 60 questionsThe Detections page in the Falcon UI allows for robust filtering to manage and triage alerts. To find detections that are currently being worked on ('In-Progress') and are assigned to a specific analyst ('Alex'), you would use the available filters. The correct method is to set the 'Status' filter to 'In-Progress' and the 'Assigned-to' filter to the analyst's name, 'Alex'.
A. The filter for assignments is labeled 'Assigned-to', not 'Analyst'. Using the incorrect filter name will yield no results.
B. The Falcon Analyst role is specifically designed to investigate and be assigned detections; this statement is factually incorrect.
C. The 'Hostname' filter is used to search for detections on a specific endpoint, not to find detections assigned to an analyst.
1. CrowdStrike, Inc. (2023). Falcon User Guide. "Detections" chapter, Section: "Filtering detections". This section provides a detailed overview of all available filters on the Detections page, including 'Status' and 'Assigned-to', and describes their usage for triaging alerts.
Keep practicing
Take the free CCFR-201b practice test
Ten exam-style questions with answers and explanations, plus the exam facts and study guides.
More questions
Other CCFR-201b practice questions
- Question 1When examining raw event data, what is the purpose of the field called ParentProcessld_de…
- Question 3Sensor Visibility Exclusion patterns are written in which syntax?
- Question 4What is the difference between a Host Search and a Host Timeline?
- Question 5Which of the following is returned from the IP Search tool?
- Question 6What action is used when you want to save a prevention hash for later use?
- Question 7Which of the following is NOT a valid event type?
