Summer Certification Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = getmirror

Home
CrowdStrike
CCFR
CCFR-201b
CrowdStrike Certified Falcon Responder Questions and Answers

Pass the CrowdStrike CCFR CCFR-201b Questions and answers with ExamsMirror

Practice at least 50% of the questions to maximize your chances of passing.

Exam CCFR-201b Premium Access

View all detail and faqs for the CCFR-201b exam

Go to Exam

516 Students Passed

94% Average Score

90% Same Questions

Viewing page 7 out of 7 pages

Viewing questions 61-70 out of questions

Questions # 61:

After pivoting to an event search from a detection, you locate the ProcessRollup2 event. Which two field values are you required to obtain to perform a Process Timeline search so you can determine what the process was doing?

Options:

SHA256 and TargetProcessld_decimal

SHA256 and ParentProcessld_decimal

aid and ParentProcessld_decimal

aid and TargetProcessld_decimal

Answer

Questions # 62:

In the Falcon Overwatch Best Practice workflow, at what specific point is a responder encouraged to utilize OSINT (Open Source Intelligence) searches?

Options:

During the ' Understand the detection ' phase.

During the ' Understand process(es) involved ' phase.

During the ' Examine what is normal for the system ' phase.

After the incident has been fully remediated.

Answer

Questions # 63:

When investigating system-level persistence, it is critical to know what the services.exe process is responsible for. What is its primary function?

Options:

Managing user profiles and registry hives during login.

Launching and managing the lifecycle of system services.

Monitoring network traffic for potential data exfiltration.

Providing a graphical interface for the Windows Task Manager.

Answer

Questions # 64:

A responder is explaining the quarantine process to a system administrator. What happens technically when a file is quarantined by the Falcon sensor?

Options:

It is deleted from the disk and a log is sent to the cloud.

It is moved to the CrowdStrike Cloud and removed from the local host immediately.

It is compressed, password protected, and moved to the Quarantine folder on the endpoint.

It is renamed to a .tmp extension and moved to the Windows Recycle Bin.

Answer

Questions # 65:

What actions are available for domain name-based Indicators of Compromise (IOCs) in Falcon?

Options:

Detect only

Allow

Block

Detect only

Allow

Block

Allow

No action

Detect only

No action

Answer

Explanation

Domain name-based IOCs in Falcon are used for detection-oriented visibility, not endpoint prevention in the same way as file-hash indicators. File hashes can support blocking or allowing because the sensor can evaluate executable content directly. Domains are network indicators, so the practical actions available are limited to detection or no enforcement action. “Detect only” creates visibility when matching activity is observed, while “No action” allows the indicator to be stored or staged without triggering enforcement behavior. Options that include “Block” or “Allow” are incorrect because domain-based IOCs do not work like hash allowlists or prevention hashes in Falcon IOC Management. This distinction is important for responders because choosing the wrong IOC type or expected action can lead to false assumptions about containment capability.

Questions # 66:

Which of the following is NOT a valid event type?

Options:

StartofProcess

EndofProcess

ProcessRollup2

DnsRequest

Answer

Questions # 67:

According to the Falcon Overwatch Best Practice workflow, what is the required next step after a responder completes the ' Understand the process(es) involved ' step?

Options:

Isolate the host to prevent lateral movement.

Examine what is normal for the system to identify deviations.

Delete the malicious file from the endpoint.

Pivot to the Intelligence dashboard for actor attribution.

Answer

Questions # 68:

When looking at the details of a detection, there are two fields called Global Prevalence and Local Prevalence. Which answer best defines Local Prevalence?

Options:

Local prevalence is the frequency with which the hash of the triggering file is seen across the entire Internet

Local Prevalence tells you how common the hash of the triggering file is within your environment (CID)

Local Prevalence is the Virus Total score for the hash of the triggering file

Local prevalence is the frequency with which the hash of the triggering file is seen across all CrowdStrike customer environments

Answer

Questions # 69:

Analyze the following process lineage observed during a detection triage on a Windows 10 workstation:

root > smss.exe > winlogon.exe > userinit.exe > explorer.exe > windows_media_player_y35s21-4ak.exe.

Based on the fact that the suspicious process originated from the user ' s desktop shell environment (explorer.exe), what is the most likely entry vector for this attack?