Summer Certification Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = getmirror

Home
CrowdStrike
CCFR
CCFR-201b
CrowdStrike Certified Falcon Responder Questions and Answers

Pass the CrowdStrike CCFR CCFR-201b Questions and answers with ExamsMirror

Practice at least 50% of the questions to maximize your chances of passing.

Exam CCFR-201b Premium Access

View all detail and faqs for the CCFR-201b exam

Go to Exam

516 Students Passed

94% Average Score

90% Same Questions

Viewing page 1 out of 7 pages

Viewing questions 1-10 out of questions

Questions # 1:

Which of the following is returned from the IP Search tool?

Options:

IP Summary information from Falcon events containing the given IP

Threat Graph Data for the given IP from Falcon sensors

Unmanaged host data from system ARP tables for the given IP

IP Detection Summary information for detection events containing the given IP

Answer

Questions # 2:

The Falcon console is divided into several modules. Timelines (Host and Process) are technically a part of which Falcon page?

Options:

Activity

Investigate

Configuration

Dashboards

Answer

Questions # 3:

Where are quarantined files stored on Windows hosts?

Options:

Windows\Quarantine

Windows\System32\Drivers\CrowdStrike\Quarantine

Windows\System32\

Windows\temp\Drivers\CrowdStrike\Quarantine

Answer

Questions # 4:

During a targeted investigation into a potentially compromised internal administrative account, a responder utilizes the User Search functionality within the Investigate menu. The goal is to identify if the account was leveraged to drop or launch unauthorized binaries across multiple systems in the environment. Which specific data category is natively visible in the User Search results to facilitate this check?

Options:

Registry Key Operations

Network File Transfer ports

Unique Executables Written and Process Executions

BIOS and Hardware modification logs

Answer

Questions # 5:

You can jump to a Process Timeline from many views, like a Hash Search, by clicking which of the following?

Options:

ProcessTimeline Link

PID

UTCtime

Process ID or Parent Process ID

Answer

Questions # 6:

Refer to the image.

Question # 6

In the Full Detection View while viewing the Process Tree you see an attack outlined as in the image above.

Based on what you see, what happened during the attack?

Options:

The attacker launched a command prompt, renamed binaries, executed malware, and prepared exfiltration

The attacker launched a command prompt to establish a reverse shell to grant remote code execution capabilities

The attacker executed malware, renamed binaries, prepared exfiltration, and deleted backups to prevent recovery

The attacker launched a command prompt, enumerated the host, created persistence, and deleted backups to prevent recovery

Answer

Explanation

The process tree shows activity consistent with command execution, system enumeration, persistence-related behavior, and backup deletion. The presence of command-line activity and utilities such as whoami indicates local host enumeration. The use of vssadmin.exe Delete Shadows /ALL /Quiet is a strong sign of backup deletion, commonly used by ransomware operators or destructive actors to prevent recovery. The tree also indicates additional commands associated with maintaining access or persistence rather than merely launching malware or preparing exfiltration. A reverse shell would require clear command syntax showing interactive network redirection, which is not the main activity here. The best interpretation is that the attacker launched a command prompt, enumerated the host, created persistence, and deleted backups to impair recovery.

Questions # 7:

If the Falcon sensor identifies suspicious behavioral patterns—such as a process attempting to dump memory from lsass.exe—what specific type of detection will be generated?

Options:

Indicator of Compromise (IOC)

Indicator of Attack (IOA)

Known Malware Alert

Intelligence Data Match

Answer

Questions # 8:

The primary purpose for running a Hash Search is to:

Options:

determine any network connections

review the processes involved with a detection

determine the origin of the detection

review information surrounding a hash ' s related activity

Answer

Questions # 9:

Responders must understand the limitations and capabilities of custom rules. Which of the following statements about custom IOAs is FALSE?

Options:

They can be used to monitor or block specific command-line strings.

A Custom IOA rule group can only be applied to one single prevention policy.

They can generate ' Informational ' detections if set to the ' Monitor ' action.

They allow for pattern matching using wildcards or specific strings.

Answer

Questions # 10:

A security analyst is triaging a high-severity alert on a critical production server. To understand the adversary ' s intent and technical execution within the framework of industry standards, the analyst refers to the console ' s categorization. Which specific methodology does CrowdStrike utilize within the Falcon platform to classify detections based on technical behavior?