thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

CrowdStrike Falcon

CrowdStrike's cloud-native endpoint and XDR platform delivered through a single lightweight sensor.

Definition

Falcon modules include Prevent (NGAV), Insight (EDR/XDR), OverWatch (managed hunting), Discover (asset inventory), Spotlight (vulnerability management) and Identity Protection. Detections are based heavily on indicators of attack, and response includes network containment and Real Time Response.

Example

Using Real Time Response to collect files from a contained host.

Exam tip

Know module names and that Falcon "contain" is network isolation of the host.

Related terms