Summer Sale Limited Time 75% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = simple75

Pass the CrowdStrike CCFR CCFR-201b Questions and answers with Dumpstech

Exam CCFR-201b Premium Access

View all detail and faqs for the CCFR-201b exam

Go to Exam
Practice at least 50% of the questions to maximize your chances of passing.
Viewing page 5 out of 7 pages
Viewing questions 41-50 out of questions
Questions # 41:

A responder needs to categorize an incident based on the high-level goals of the attacker. Which of the following lists correctly identifies the " Objectives " as they are natively defined and used within the Falcon platform?

Options:

A.

Explore, Keep Access, Gain Access, Falcon Detection Method, Contact Controlled systems, Follow Through

B.

Reconnaissance, Delivery, Weaponization, Exploitation, Installation, Command and Control

C.

Identify, Protect, Detect, Respond, Recover, Lessons Learned

D.

Triage, Containment, Remediation, Eradication, Reporting, Recovery

Questions # 42:

In various telemetry events like ' FileWrite ' or ' NetworkConnect ' , Falcon identifies the process that performed the action. Which field will always identify this " acting " process?

Options:

A.

ContextProcessId_decimal

B.

TargetProcessId_decimal

C.

ParentProcessId_decimal

D.

OwnerProcessId_decimal

Questions # 43:

What happens when a quarantined file is released?

Options:

A.

It is moved into theC:\CrowdStrike\Quarantine\Releasedfolder on the host

B.

It is allowed to execute on the host

C.

It is deleted

D.

It is allowed to execute on all hosts

Questions # 44:

What happens when a hash is set to Always Block through IOC Management?

Options:

A.

Execution is prevented on all hosts by default

B.

Execution is prevented on selected host groups

C.

Execution is prevented and detection alerts are suppressed

D.

The hash is submitted for approval to be blocked from execution once confirmed by Falcon specialists

Questions # 45:

While examining the ' Process Details ' sidebar of a detection, a responder sees the following icons: " 25 Network Operations " and " 277 Disk Operations " . What does this contextual data represent?

Options:

A.

The percentage of the CPU being consumed by the network and disk.

B.

The specific number of telemetry events recorded for network and disk activity by that process.

C.

The total size in megabytes of the data sent over the network and written to disk.

D.

The number of other hosts that have seen similar network and disk activity.

Questions # 46:

Which option indicates a hash is allowlisted?

Options:

A.

No Action

B.

Allow

C.

Ignore

D.

Always Block

Questions # 47:

An analyst needs to perform local sandbox analysis on a malicious file. When they download a quarantined file from the Falcon UI, what is the file format and the default password?

Options:

A.

.zip, password: crowdstrike

B.

.7-zip, password: infected

C.

.rar, password: malware

D.

.exe, no password

Questions # 48:

During the triage of a detection involving a newly created persistent task, which specific indicator is most important for a responder to identify the actual intent of the service?

Options:

A.

The total CPU usage of the parent process.

B.

The command-line arguments used during the task creation.

C.

The Agent ID (AID) of the host where the detection fired.

D.

The physical location of the endpoint in the office.

Questions # 49:

While reviewing the ' Detection Method ' field for a high-severity alert, a responder sees the label ' Post-Exploit ' . This terminology is used by CrowdStrike to identify a specific:

Options:

A.

Falcon Detection Method

B.

MITRE Tactic

C.

Indicator of Attack (IOA)

D.

Prevention Policy Level

Questions # 50:

From the Detections page, how can you view ' in-progress ' detections assigned to Falcon Analyst Alex?

Options:

A.

Filter on ' Analyst: Alex '

B.

Alex does not have the correct role permissions as a Falcon Analyst to be assigned detections

C.

Filter on ' Hostname: Alex ' and ' Status: In-Progress '

D.

Filter on ' Status: In-Progress ' and ' Assigned-to: Alex*

Viewing page 5 out of 7 pages
Viewing questions 41-50 out of questions