Summer Sale Limited Time 75% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = simple75

Pass the CrowdStrike CCFR CCFR-201b Questions and answers with Dumpstech

Exam CCFR-201b Premium Access

View all detail and faqs for the CCFR-201b exam

Go to Exam
Practice at least 50% of the questions to maximize your chances of passing.
Viewing page 7 out of 7 pages
Viewing questions 61-70 out of questions
Questions # 61:

During a targeted investigation into a potentially compromised internal administrative account, a responder utilizes the User Search functionality within the Investigate menu. The goal is to identify if the account was leveraged to drop or launch unauthorized binaries across multiple systems in the environment. Which specific data category is natively visible in the User Search results to facilitate this check?

Options:

A.

Registry Key Operations

B.

Network File Transfer ports

C.

Unique Executables Written and Process Executions

D.

BIOS and Hardware modification logs

Questions # 62:

Depending on the subscription level, " Cloudable Events " (standard telemetry) have a specific retention period. What is the minimum period of time that these events are retained?

Options:

A.

1 day

B.

7 days

C.

14 days

D.

30 days

Questions # 63:

A security analyst is triaging a high-severity alert on a critical production server. To understand the adversary ' s intent and technical execution within the framework of industry standards, the analyst refers to the console ' s categorization. Which specific methodology does CrowdStrike utilize within the Falcon platform to classify detections based on technical behavior?

Options:

A.

MITRE-Based Falcon Detections Framework

B.

NIST Incident Response Lifecycle

C.

Falcon Adversary Attribution Matrix

D.

Cyber Kill Chain Classification

Questions # 64:

In the Falcon Overwatch Best Practice workflow, at what specific point is a responder encouraged to utilize OSINT (Open Source Intelligence) searches?

Options:

A.

During the ' Understand the detection ' phase.

B.

During the ' Understand process(es) involved ' phase.

C.

During the ' Examine what is normal for the system ' phase.

D.

After the incident has been fully remediated.

Questions # 65:

Which Executive Summary dashboard item indicates sensors running with unsupported versions?

Options:

A.

Detections by Severity

B.

Inactive Sensors

C.

Sensors in RFM

D.

Active Sensors

Questions # 66:

The Falcon sensor is designed to provide deep visibility into endpoint activity, yet it is not omniscient. According to the Cyber Kill Chain model, which of the following stages does the Falcon sensor typically NOT have visibility over?

Options:

A.

Exploitation of a memory-resident vulnerability

B.

Installation of a persistent backdoor

C.

Weaponization of a malicious payload on the adversary ' s infrastructure

D.

Delivery of a malicious document via an encrypted email attachment

Questions # 67:

The MITRE-Based Falcon Detections Framework is a core component of the Falcon UI. What is the primary operational advantage provided by this framework to a Tier 1 responder?

Options:

A.

It allows for the automated decryption of files affected by ransomware.

B.

It provides a standardized view of the attack lifecycle to help understand adversary behavior.

C.

It enables the sensor to block kernel-level drivers from unknown publishers.

D.

It provides a real-time count of the total number of files on the endpoint.

Questions # 68:

When examining a detection process tree, several fields are provided to give context. Which of the following is NOT included in the standard fields of a detection process tree?

Options:

A.

Command Line

B.

User Name

C.

HTTP Post contents

D.

SHA256 Hash

Questions # 69:

When reviewing CrowdScore Incidents, which of the following statements is INCORRECT?

Options:

A.

Incidents aggregate related detections to reduce alert fatigue.

B.

Incidents are defined as inactive after 10 hours pass without any new related activity.

C.

A high CrowdScore indicates a higher likelihood of a sophisticated or widespread attack.

D.

CrowdScore is only visible to users with the ' Falcon Administrator ' role.

Questions # 70:

Which of the following subtitles/sub-views cannot be seen in the results of a ' Hash Search ' ?

Options:

A.

File Metadata

B.

Process Timeline

C.

Intel Indicators

D.

Execution History

Viewing page 7 out of 7 pages
Viewing questions 61-70 out of questions