Summer Certification Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = getmirror

Home
CrowdStrike
CCFR
CCFR-201b
CrowdStrike Certified Falcon Responder Questions and Answers

Pass the CrowdStrike CCFR CCFR-201b Questions and answers with ExamsMirror

Practice at least 50% of the questions to maximize your chances of passing.

Exam CCFR-201b Premium Access

View all detail and faqs for the CCFR-201b exam

Go to Exam

516 Students Passed

94% Average Score

90% Same Questions

Viewing page 3 out of 7 pages

Viewing questions 21-30 out of questions

Questions # 21:

When examining a detection process tree, several fields are provided to give context. Which of the following is NOT included in the standard fields of a detection process tree?

Options:

Command Line

User Name

HTTP Post contents

SHA256 Hash

Answer

Questions # 22:

Detections in Falcon are classified by their origin. Which of the following is NOT a recognized type of detection?

Options:

Machine Learning

Behavioral

Intelligence

Custom IOA

Answer

Questions # 23:

By default, when a file is quarantined by the Falcon sensor to prevent execution, how many days does that file remain on the host ' s local disk?

Options:

7 days

14 days

30 days

90 days

Answer

Questions # 24:

How long does detection data remain in the CrowdStrike Cloud before purging begins?

Options:

90 Days

45 Days

30 Days

14 Days

Answer

Questions # 25:

The Process Activity View provides a rows-and-columns style view of the events generated in a detection. Why might this be helpful?

Options:

The Process Activity View creates a consolidated view of all detection events for that process that can be exported for further analysis

The Process Activity View will show the Detection time of the earliest recorded activity which might indicate first affected machine

The Process Activity View only creates a summary of Dynamic Link Libraries (DLLs) loaded by a process

The Process Activity View creates a count of event types only, which can be useful when scoping the event

Answer

Questions # 26:

According to the Falcon Overwatch Best Practice workflow, what is the required next step after a responder completes the ' Understand the process(es) involved ' step?

Options:

Isolate the host to prevent lateral movement.

Examine what is normal for the system to identify deviations.

Delete the malicious file from the endpoint.

Pivot to the Intelligence dashboard for actor attribution.

Answer

Questions # 27:

When managing files within the ' Quarantined Files ' dashboard, which of the following is NOT a valid action available to the responder?

Options:

Release

Download

Investigate

Delete

Answer

Questions # 28:

Evaluate the following process tree observed in a detection:

root > smss.exe > winlogon.exe > userinit.exe > explorer.exe > windows_media_player_y35s21-4ak.exe

Based on the parent-child relationships, which entry source is most likely?

Options:

A remote service exploitation targeting a system process.

A phishing attack where the user executed a malicious file from the desktop.

A scheduled task running under the SYSTEM account.

A supply chain attack targeting the Windows Boot manager.

Answer

Questions # 29:

When a responder is looking at the ' Full Detection Details ' page, they can toggle between several views. Which of the following is NOT a layout option available for viewing these details?