Summer Sale Limited Time 75% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = simple75

Pass the CrowdStrike CCFR CCFR-201b Questions and answers with Dumpstech

Exam CCFR-201b Premium Access

View all detail and faqs for the CCFR-201b exam

Go to Exam
Practice at least 50% of the questions to maximize your chances of passing.
Viewing page 2 out of 7 pages
Viewing questions 11-20 out of questions
Questions # 11:

When analyzing the raw telemetry for a ' DNSRequest ' event, which of the following raw data fields is available to the responder?

Options:

A.

browser_type

B.

index

C.

cpu_usage_percent

D.

monitor_mode

Questions # 12:

You found a list of SHA256 hashes in an intelligence report and search for them using the Hash Execution Search. What can be determined from the results?

Options:

A.

Identifies a detailed list of all process executions for the specified hashes

B.

Identifies hosts that loaded or executed the specified hashes

C.

Identifies users associated with the specified hashes

D.

Identifies detections related to the specified hashes

Questions # 13:

If the Falcon sensor identifies suspicious behavioral patterns—such as a process attempting to dump memory from lsass.exe—what specific type of detection will be generated?

Options:

A.

Indicator of Compromise (IOC)

B.

Indicator of Attack (IOA)

C.

Known Malware Alert

D.

Intelligence Data Match

Questions # 14:

Which of the following is an example of a MITRE ATT AND CK tactic?

Options:

A.

Eternal Blue

B.

Defense Evasion

C.

Emotet

D.

Phishing

Questions # 15:

When looking at the details of a detection, there are two fields called Global Prevalence and Local Prevalence. Which answer best defines Local Prevalence?

Options:

A.

Local prevalence is the frequency with which the hash of the triggering file is seen across the entire Internet

B.

Local Prevalence tells you how common the hash of the triggering file is within your environment (CID)

C.

Local Prevalence is the Virus Total score for the hash of the triggering file

D.

Local prevalence is the frequency with which the hash of the triggering file is seen across all CrowdStrike customer environments

Questions # 16:

What information is contained within a Process Timeline?

Options:

A.

All cloudable process-related events within a given timeframe

B.

All cloudable events for a specific host

C.

Only detection process-related events within a given timeframe

D.

A view of activities on Mac or Linux hosts

Questions # 17:

In the Falcon console, detections can be automated or manual. Which of the following options represents a manual detection?

Options:

A.

A detection triggered by the Machine Learning engine.

B.

A Falcon Overwatch-pushed detection.

C.

A detection based on a Custom IOA.

D.

A detection matched against a known Intelligence IOC.

Questions # 18:

A responder decides to set a specific Custom IOA to the ' Monitor ' action. Which of the following sentences best describes the technical result of this choice?

Options:

A.

The sensor will block the activity and alert the user with a pop-up.

B.

The sensor will create detections with ' Informational ' severity but will not block the activity.

C.

The sensor will log the activity in the audit logs but will not generate a detection.

D.

The sensor will automatically isolate the host from the network.

Questions # 19:

When examining a raw DNS request event, you see a field called ContextProcessld_decimal. What is the purpose of that field?

Options:

A.

It contains the TargetProcessld_decimal value for other related events

B.

It contains an internal value not useful for an investigation

C.

It contains the ContextProcessld_decimal value for the parent process that made the DNS request

D.

It contains the TargetProcessld_decimal value for the process that made the DNS request

Questions # 20:

The function of Machine Learning Exclusions is to___________.

Options:

A.

stop all detections for a specific pattern ID

B.

stop all sensor data collection for the matching path(s)

C.

Stop all Machine Learning Preventions but a detection will still be generated and files will still be uploaded to the CrowdStrike Cloud

D.

stop all ML-based detections and preventions for the matching path(s) and/or stop files from being uploaded to the CrowdStrike Cloud

Viewing page 2 out of 7 pages
Viewing questions 11-20 out of questions