Summer Sale Limited Time 75% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = simple75

Pass the CrowdStrike CCFR CCFR-201b Questions and answers with Dumpstech

Home
CrowdStrike
CCFR
CCFR-201b
CCFR-201b Questions and Answers

Exam CCFR-201b Premium Access

View all detail and faqs for the CCFR-201b exam

Go to Exam

Practice at least 50% of the questions to maximize your chances of passing.

Viewing page 1 out of 7 pages

Viewing questions 1-10 out of questions

Questions # 1:

To understand how a threat moved on a system, a responder must know the role of common processes. Which of the following statements best describes the standard functionality of explorer.exe?

Options:

It is a system process responsible for the Local Security Authority subsystem.

It is the primary process responsible for the File Explorer UI and the user ' s desktop environment.

It is the Windows Command Processor used for executing batch files.

It is the service control manager that handles the starting of background tasks.

Answer

Questions # 2:

Data retention is a key factor in retrospective hunting. How long will " Detection Related Events " be retained in the Falcon environment?

Options:

30 days

60 days

90 days

1 year

Answer

Questions # 3:

While most searches are accessible from a detection, some require a manual jump. Which search is not available as a direct pivot from a detection?

Options:

Host Search

Hash Search

User Search

IP Search

Answer

Questions # 4:

A responder needs to view a high-level overview of the environment ' s security posture. Where can they find the ' Activity Dashboard ' ?

Options:

Investigate > Activity Dashboard

Endpoint Security > Monitor > Activity Dashboard

Configuration > General > Activity Dashboard

Support > Analytics > Activity Dashboard

Answer

Questions # 5:

What action is needed to ensure Falcon does not block or generate a detection for a process by using the file hash?

Options:

Create a Custom IOC with an action of allow for the hash

Create a Machine Learning Exclusion with an action of allow for the hash

Create a Custom IOA with an action of allow for the hash

Create an IOA Exclusion with an action of allow for the hash

Answer

Explanation

To ensure Falcon does not block or generate a detection for a specific process based on its file hash, the correct approach is to create a Custom IOC with an allow action for that hash. Hash-based allowlisting is tied to the file’s cryptographic identity, which makes it appropriate when the organization trusts that exact binary. A Machine Learning Exclusion is path-oriented and affects ML detections or uploads, not necessarily all hash-based IOC logic. A Custom IOA detects behavior patterns, not static file hashes. An IOA Exclusion reduces false positives for behavioral detections but is not the correct mechanism for allowing a specific hash. For Falcon responders, this distinction prevents overbroad exclusions and keeps allowlisting tightly scoped.

Questions # 6:

Falcon uses specific identifiers to track processes across the environment. Which of the following sentences best describes what the ' TargetProcessId_decimal ' raw data represents?

Options:

The standard Process ID (PID) assigned by the Windows operating system.

A sensor-assigned decimal number that is unique for each process across time and hosts.

The memory address where the process’s executable is loaded.

The total number of seconds the process has been running.

Answer

Questions # 7:

After running an Event Search, you can select many Event Actions depending on your results. Which of the following is NOT an option for any Event Action?

Options:

Draw Process Explorer

Show a +/- 10-minute window of events

Show a Process Timeline for the responsible process

Show Associated Event Data (from TargetProcessld_decimal or ContextProcessld_decimal)

Answer

Questions # 8:

In the ' User Search - File Written ' section, a responder can see various files dropped by a user. Which of the following file types CANNOT be seen from this view?

Options:

Scripts (.ps1, .sh)

Executables (.exe)

Executions (Process starts)

Archive files (.zip, .7z)

Answer

Questions # 9:

When navigating the main ' Detections ' page, several filters are available in the dropdown menu. Which of the following is NOT a filter available in this menu?

Options:

Severity

Tactic

Location tag

Status

Answer

Questions # 10:

An analyst is triaging a detection that has been categorized under the ‘Follow Through’ Objective Layer. Based on the Falcon technical documentation, which of the following adversary tactics is most likely to be observed within this specific layer?

Options:

Credential Access through memory scraping

Collection of sensitive data for exfiltration

Initial Access via a drive-by download

Discovery of local network shares and services

Answer

Viewing page 1 out of 7 pages

Viewing questions 1-10 out of questions

Modal title

Registered Required

In order to participate in the comments you need to be logged-in.
You can sign-up or login (it's free).