Summer Certification Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = getmirror

Home
CrowdStrike
CCFR
CCFR-201b
CrowdStrike Certified Falcon Responder Questions and Answers

Pass the CrowdStrike CCFR CCFR-201b Questions and answers with ExamsMirror

Practice at least 50% of the questions to maximize your chances of passing.

Exam CCFR-201b Premium Access

View all detail and faqs for the CCFR-201b exam

Go to Exam

516 Students Passed

94% Average Score

90% Same Questions

Viewing page 4 out of 7 pages

Viewing questions 31-40 out of questions

Questions # 31:

A responder is explaining the quarantine process to a system administrator. What happens technically when a file is quarantined by the Falcon sensor?

Options:

It is deleted from the disk and a log is sent to the cloud.

It is moved to the CrowdStrike Cloud and removed from the local host immediately.

It is compressed, password protected, and moved to the Quarantine folder on the endpoint.

It is renamed to a .tmp extension and moved to the Windows Recycle Bin.

Answer

Questions # 32:

A responder needs to find a specific sequence of network connections that did not trigger a detection. Which search tool allows them to search for anything within the raw telemetry?

Options:

Host Search

Event Search

Hash Search

User Search

Answer

Questions # 33:

Responders use ' IP Search ' to track connections to malicious infrastructure. Which of the following statements about the IP Search is FALSE?

Options:

It identifies every host that connected to a specific IP.

It provides Intel data if the IP is known to CrowdStrike.

The search only allows for one IP to be entered at a time.

It shows the first and last time the IP was seen in the environment.

Answer

Questions # 34:

Refer to Image:

Question # 34

You are investigating a network connection in event search.

Which option next to the raw event data should you select to pivot to a graphical representation for all the processes related to the network connection event?

Options:

Inspect

Show Responsible Process Data

Draw Process Explorer

Show Associated Event Data

Answer

Explanation

The correct option is Draw Process Explorer because the question asks for a graphical representation of the process relationships associated with the network connection event. Process Explorer is used to visualize process lineage, parent-child relationships, and related process activity in a graph-style view. “Inspect” displays raw details about the selected event but does not create a graph. “Show Responsible Process Data” pivots to the process responsible for the event, which is useful, but it is not the graphical process representation requested. “Show Associated Event Data” expands related event context but remains data-oriented rather than graph-oriented. In Falcon event investigations, Process Explorer is valuable when the responder needs to understand how a suspicious network event fits into the broader process chain.

Questions # 35:

What action is needed to ensure Falcon does not block or generate a detection for a process by using the file hash?

Options:

Create a Custom IOC with an action of allow for the hash

Create a Machine Learning Exclusion with an action of allow for the hash

Create a Custom IOA with an action of allow for the hash

Create an IOA Exclusion with an action of allow for the hash

Answer

Explanation

To ensure Falcon does not block or generate a detection for a specific process based on its file hash, the correct approach is to create a Custom IOC with an allow action for that hash. Hash-based allowlisting is tied to the file’s cryptographic identity, which makes it appropriate when the organization trusts that exact binary. A Machine Learning Exclusion is path-oriented and affects ML detections or uploads, not necessarily all hash-based IOC logic. A Custom IOA detects behavior patterns, not static file hashes. An IOA Exclusion reduces false positives for behavioral detections but is not the correct mechanism for allowing a specific hash. For Falcon responders, this distinction prevents overbroad exclusions and keeps allowlisting tightly scoped.

Questions # 36:

When reviewing a Host Timeline, which of the following filters is available?

Options:

Severity

Event Types

User Name

Detection ID

Answer

Questions # 37:

You found a list of SHA256 hashes in an intelligence report and search for them using the Hash Execution Search. What can be determined from the results?

Options:

Identifies a detailed list of all process executions for the specified hashes

Identifies hosts that loaded or executed the specified hashes

Identifies users associated with the specified hashes

Identifies detections related to the specified hashes

Answer

Questions # 38:

In the Falcon console, detections can be automated or manual. Which of the following options represents a manual detection?

Options:

A detection triggered by the Machine Learning engine.

A Falcon Overwatch-pushed detection.

A detection based on a Custom IOA.

A detection matched against a known Intelligence IOC.

Answer

Questions # 39:

A responder needs to categorize an incident based on the high-level goals of the attacker. Which of the following lists correctly identifies the " Objectives " as they are natively defined and used within the Falcon platform?

Options:

Explore, Keep Access, Gain Access, Falcon Detection Method, Contact Controlled systems, Follow Through

Reconnaissance, Delivery, Weaponization, Exploitation, Installation, Command and Control

Identify, Protect, Detect, Respond, Recover, Lessons Learned

Triage, Containment, Remediation, Eradication, Reporting, Recovery

Answer

Questions # 40:

During the triage of a detection involving a newly created persistent task, which specific indicator is most important for a responder to identify the actual intent of the service?