Summer Sale Limited Time 75% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = simple75

Pass the CrowdStrike CCFR CCFR-201b Questions and answers with Dumpstech

Exam CCFR-201b Premium Access

View all detail and faqs for the CCFR-201b exam

Go to Exam
Practice at least 50% of the questions to maximize your chances of passing.
Viewing page 6 out of 7 pages
Viewing questions 51-60 out of questions
Questions # 51:

Within the context of CrowdStrike’s behavioral detection engine, what does the acronym ' IOA ' stand for?

Options:

A.

Indicator of Activity

B.

Indicator of Attack

C.

Integrated Operation Alert

D.

Internal Objective Analysis

Questions # 52:

What is the difference between Managed and Unmanaged Neighbors in the Falcon console?

Options:

A.

A managed neighbor is currently network contained and an unmanaged neighbor is uncontained

B.

A managed neighbor has an installed and provisioned sensor

C.

An unmanaged neighbor is in a segmented area of the network

D.

A managed sensor has an active prevention policy

Questions # 53:

How does a DNSRequest event link to its responsible process?

Options:

A.

Via both its ContextProcessld__decimal and ParentProcessld_decimal fields

B.

Via its ParentProcessld_decimal field

C.

Via its ContextProcessld_decimal field

D.

Via its TargetProcessld_decimal field

Questions # 54:

In the " Full Detection Details " , which view will provide an exportable text listing of events like DNS requests. Registry Operations, and Network Operations?

Options:

A.

Thedata is unable to be exported

B.

View as Process Tree

C.

View as Process Timeline

D.

View as Process Activity

Questions # 55:

A responder is explaining the quarantine process to a system administrator. What happens technically when a file is quarantined by the Falcon sensor?

Options:

A.

It is deleted from the disk and a log is sent to the cloud.

B.

It is moved to the CrowdStrike Cloud and removed from the local host immediately.

C.

It is compressed, password protected, and moved to the Quarantine folder on the endpoint.

D.

It is renamed to a .tmp extension and moved to the Windows Recycle Bin.

Questions # 56:

Which of the following is returned from the IP Search tool?

Options:

A.

IP Summary information from Falcon events containing the given IP

B.

Threat Graph Data for the given IP from Falcon sensors

C.

Unmanaged host data from system ARP tables for the given IP

D.

IP Detection Summary information for detection events containing the given IP

Questions # 57:

When viewing the main ' Quarantine ' dashboard to manage blocked files, which of the following pieces of information CANNOT be seen by default?

Options:

A.

Filename

B.

Host Name

C.

Hash

D.

Date Quarantined

Questions # 58:

Where are quarantine files located on a Mac Endpoint?

Options:

A.

/tmp/cs/quarantine

B.

/Library/CS/Quarantine

C.

/Applications/Falcon/Quarantine

D.

/Users/Shared/CS/Quarantine

Questions # 59:

A responder releases a file from quarantine on a specific workstation. What is the default scope of the allowlist that is created during this process?

Options:

A.

Global (applies to all hosts in the environment)

B.

Only the specific host where the file was originally quarantined

C.

All hosts within the same host group as the source host

D.

All hosts running the same operating system version

Questions # 60:

A responder has identified a suspicious PowerShell script executing on a domain controller. To perform a deep-dive forensic analysis of every action taken by that specific process—including network connections and file modifications—the analyst needs to pivot to a Process Timeline. What is the absolute minimum telemetry data required to generate this auto-filled view?

Options:

A.

Agent ID (AID) and Local IP Address

B.

Agent ID (AID) and Target Process ID (TargetProcessId_decimal)

C.

Hostname and MAC Address

D.

User SID and SHA256 Hash

Viewing page 6 out of 7 pages
Viewing questions 51-60 out of questions