Summer Sale Limited Time 75% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = simple75

Pass the CrowdStrike CCFR CCFR-201b Questions and answers with Dumpstech

Home
CrowdStrike
CCFR
CCFR-201b
CCFR-201b Questions and Answers

Exam CCFR-201b Premium Access

View all detail and faqs for the CCFR-201b exam

Go to Exam

Practice at least 50% of the questions to maximize your chances of passing.

Viewing page 3 out of 7 pages

Viewing questions 21-30 out of questions

Questions # 21:

When performing a ' Hash Search ' , which of the following is NOT a filter available for use?

Options:

SHA256

MD5

File Type

Filename

Answer

Questions # 22:

What is an advantage of using the IP Search tool?

Options:

IP searches provide manufacture and timezone data that can not be accessed anywhere else

IP searches allow for multiple comma separated IPv6 addresses as input

IP searches offer shortcuts to launch response actions and network containment on target hosts

IP searches provide host, process, and organizational unit data without the need to write a query

Answer

Questions # 23:

The ' Detection Resolutions ' dashboard helps track team performance. Which of the following CANNOT be seen from this dashboard?

Options:

Average time to resolve a detection.

Total number of detections resolved by each analyst.

The top 10 hosts/users/files with the most detections.

The breakdown of True Positive vs. False Positive resolutions.

Answer

Questions # 24:

To speed up investigations, Falcon uses ' event workflows ' . Which of the following sentences best describes what event workflows are?

Options:

They are automated scripts that perform remediation actions like killing processes.

They are automated searches that can be used to pivot between related events and searches.

They are PDF reports that summarize an incident for executive review.

They are schedules for when the sensor should perform a full disk scan.

Answer

Questions # 25:

What do IOA exclusions help you achieve?

Options:

Reduce false positives based on Next-Gen Antivirus settings in the Prevention Policy

Reduce false positives of behavioral detections from IOA based detections only

Reduce false positives of behavioral detections from IOA based detections based on a file hash

Reduce false positives of behavioral detections from Custom IOA and OverWatch detections only

Answer

Questions # 26:

Administrators can define their own criteria for alerts. Which of the following is an example of a custom detection within the Falcon platform?

Options:

Sensor-based Malware Detections

Blacklisted Hashes

Overwatch Managed Detections

Behavioral IOA Detections

Answer

Questions # 27:

While investigating a detection, you pivot to the Advanced Event Search.

Which field would you filter by to return events executing from a specific directory on the host?

Options:

TreeId

@source

ParentBaseFileName

FilePath

Answer

Explanation

The correct field is FilePath because the investigation is focused on events executing from a specific directory on the host. In Falcon Event Search, path-based filtering is used when a responder wants to identify activity tied to a folder location such as a user profile, temp directory, startup folder, or suspicious staging path. TreeId is related to process lineage and is not the right field for directory matching. @source identifies the data source or index-related context, not the executable location. ParentBaseFileName is useful when searching for child processes launched by a specific parent executable, but it does not identify where the executing file resides. FilePath directly maps to the file location, making it the correct field for directory-based event hunting.

Questions # 28:

During an advanced hunting session, a responder is writing a custom query in the Event Search tool to track the lineage of a suspicious process. They notice a field labeled TargetProcessId_decimal. Which of the following sentences accurately describes the technical significance of this value within the CrowdStrike telemetry ecosystem?

Options:

It is the standard Process ID (PID) assigned by the Windows Task Manager.

It is a sensor-assigned, environment-wide unique decimal identifier for that specific process instance.

It represents the memory offset where the process ' s primary thread began.

It is a count of the total number of child processes spawned by that executable.

Answer

Questions # 29:

In the Hash Search tool, which of the following is listed under Process Executions?

Options:

Operating System

File Signature

Command Line

Sensor Version

Answer

Questions # 30:

An analyst notices a detection that has been automatically flagged with the ' New Activity ' status. Which of the following statements best describes what this status indicates?

Options:

A brand new detection has been triggered on a host that was recently added to the network.

A detection that was previously moved to a resolved status has generated new telemetry and activity.

A user has logged into a machine for the first time since the sensor was installed.

The Falcon Overwatch team has manually verified that the detection is an active threat.

Answer

Viewing page 3 out of 7 pages

Viewing questions 21-30 out of questions

Modal title

Registered Required

In order to participate in the comments you need to be logged-in.
You can sign-up or login (it's free).