Summer Certification Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = getmirror

Home
CrowdStrike
CCFR
CCFR-201b
CrowdStrike Certified Falcon Responder Questions and Answers

Pass the CrowdStrike CCFR CCFR-201b Questions and answers with ExamsMirror

Practice at least 50% of the questions to maximize your chances of passing.

Exam CCFR-201b Premium Access

View all detail and faqs for the CCFR-201b exam

Go to Exam

516 Students Passed

94% Average Score

90% Same Questions

Viewing page 5 out of 7 pages

Viewing questions 41-50 out of questions

Questions # 41:

A responder has identified a suspicious PowerShell script executing on a domain controller. To perform a deep-dive forensic analysis of every action taken by that specific process—including network connections and file modifications—the analyst needs to pivot to a Process Timeline. What is the absolute minimum telemetry data required to generate this auto-filled view?

Options:

Agent ID (AID) and Local IP Address

Agent ID (AID) and Target Process ID (TargetProcessId_decimal)

Hostname and MAC Address

User SID and SHA256 Hash

Answer

Questions # 42:

The function of Machine Learning Exclusions is to___________.

Options:

stop all detections for a specific pattern ID

stop all sensor data collection for the matching path(s)

Stop all Machine Learning Preventions but a detection will still be generated and files will still be uploaded to the CrowdStrike Cloud

stop all ML-based detections and preventions for the matching path(s) and/or stop files from being uploaded to the CrowdStrike Cloud

Answer

Questions # 43:

What is the difference between Managed and Unmanaged Neighbors in the Falcon console?

Options:

A managed neighbor is currently network contained and an unmanaged neighbor is uncontained

A managed neighbor has an installed and provisioned sensor

An unmanaged neighbor is in a segmented area of the network

A managed sensor has an active prevention policy

Answer

Questions # 44:

An analyst wants to see the raw events behind a specific detection. Which icon in the UI allows them to pivot directly to an event search?

Options:

Shield icon

Spyglass icon

Trash can icon

Gear icon

Answer

Questions # 45:

Which of the following sentences best describes the technical visibility provided by the ' Host Timeline ' view?

Options:

A list of every time a user has logged in or out of the machine.

Every host-relevant event (Process, File, Registry, Network) recorded in a given timeframe.

A history of every hardware change or driver update on the endpoint.

A log of every time the Falcon sensor was updated or restarted.

Answer

Questions # 46:

The Falcon sensor can take several automated actions to protect an endpoint. Which of the following is NOT an action that Falcon takes upon detection?

Options:

Process Termination

File Quarantine

Process Restart

Network Isolation

Answer

Questions # 47:

When navigating the ' Custom IOA ' creation wizard, a user must select a rule type. Which of the following is NOT a valid IOA rule type available for selection?

Options:

Process Creation

File Creation

Domain Name

Scheduled Task

Answer

Questions # 48:

How are processes on the same plane ordered (bottom ' VMTOOLSD.EXE ' to top CMD.EXE ' )?

Question # 48

Options:

Process ID (Descending, highest on bottom)

Time started (Descending, most recent on bottom)

Time started (Ascending, most recent on top)

Process ID (Ascending, highest on top)

Answer

Questions # 49:

CrowdStrike provides ' Overwatch Best Practices ' for triaging alerts. According to these guidelines, what is the next step a responder should take immediately after the ' Understand the detection ' step?