Summer Certification Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = getmirror

Home
CrowdStrike
CCFR
CCFR-201b
CrowdStrike Certified Falcon Responder Questions and Answers

Pass the CrowdStrike CCFR CCFR-201b Questions and answers with ExamsMirror

Practice at least 50% of the questions to maximize your chances of passing.

Exam CCFR-201b Premium Access

View all detail and faqs for the CCFR-201b exam

Go to Exam

516 Students Passed

94% Average Score

90% Same Questions

Viewing page 2 out of 7 pages

Viewing questions 11-20 out of questions

Questions # 11:

CrowdScore is a metric used to identify the severity of an ongoing incident. What percentage of increase in a CrowdScore is considered a strong indication of a coordinated attack?

Options:

10%

20%

50%

100%

Answer

Questions # 12:

Which of the following statements about the ' Hash Search ' (Single Search) is TRUE?

Options:

It can search for both files and registry keys simultaneously.

It identifies the geographical location of the file ' s creator.

The ' Hash Written History ' section is only available for SHA256 hashes.

It is primarily used to isolate a host from the network.

Answer

Questions # 13:

While in an Event Search, a responder clicks on an event action. What does the ' Show Child Processes ' event action do?

Options:

It displays a list of children in a new graphical tree.

It generates a new Event Search based on the specific Event Action and Parent PID.

It automatically terminates all children of that process on the endpoint.

It pivots to the Host Search for the machine where the process ran.

Answer

Questions # 14:

Which of the following is NOT a valid event type?

Options:

StartofProcess

EndofProcess

ProcessRollup2

DnsRequest

Answer

Questions # 15:

Aside from a Process Timeline or Event Search, how do you export process event data from a detection in .CSV format?

Options:

You can ' t export detailed event data from a detection, you have to use the Process Timeline or an Event Search

In Full Detection Details, you expand the nodes of the process tree you wish to expand and then click the " Export Process Events " button

In Full Detection Details, you choose the " View Process Activity " option and then export from that view

From the Detections Dashboard, you right-click the event type you wish to export and choose CSV. JSON or XML

Answer

Questions # 16:

In the " Full Detection Details " , which view will provide an exportable text listing of events like DNS requests. Registry Operations, and Network Operations?

Options:

Thedata is unable to be exported

View as Process Tree

View as Process Timeline

View as Process Activity

Answer

Questions # 17:

What happens when a hash is allowlisted?

Options:

Execution is prevented, but detection alerts are suppressed

Execution is allowed on all hosts, including all other Falcon customers

The hash is submitted for approval to be allowed to execute once confirmed by Falcon specialists

Execution is allowed on all hosts that fall under the organization ' s CID

Answer

Questions # 18:

While quarantined files stay on the local host for 30 days by default, how many days does a quarantined file remain stored in the CrowdStrike Cloud?

Options:

30 days

60 days

90 days

180 days

Answer

Questions # 19:

Administrators can define their own criteria for alerts. Which of the following is an example of a custom detection within the Falcon platform?

Options:

Sensor-based Malware Detections

Blacklisted Hashes

Overwatch Managed Detections

Behavioral IOA Detections

Answer

Questions # 20:

During an advanced hunting session, a responder is writing a custom query in the Event Search tool to track the lineage of a suspicious process. They notice a field labeled TargetProcessId_decimal. Which of the following sentences accurately describes the technical significance of this value within the CrowdStrike telemetry ecosystem?