[Q19-Q41] Best Quality CrowdStrike CCFR-201 Exam Questions PassLeaderVCE Realistic Practice Exams [2024]

Rate this post

Best Quality CrowdStrike CCFR-201 Exam Questions PassLeaderVCE Realistic Practice Exams [2024]

Critical Information To CrowdStrike Certified Falcon Responder Pass the First Time

NO.19 You found a list of SHA256 hashes in an intelligence report and search for them using the Hash Execution Search. What can be determined from the results?

Identifies a detailed list of all process executions for the specified hashes

Identifies hosts that loaded or executed the specified hashes

Identifies users associated with the specified hashes

Identifies detections related to the specified hashes

NO.20 Aside from a Process Timeline or Event Search, how do you export process event data from a detection in
.CSV format?

You can’t export detailed event data from a detection, you have to use the Process Timeline or an Event Search

In Full Detection Details, you expand the nodes of the process tree you wish to expand and then click the “Export Process Events” button

In Full Detection Details, you choose the “View Process Activity” option and then export from that view

From the Detections Dashboard, you right-click the event type you wish to export and choose CSV.JSON or XML

NO.21 Which Executive Summary dashboard item indicates sensors running with unsupported versions?

Detections by Severity

Inactive Sensors

Sensors in RFM

Active Sensors

NO.22 You are notified by a third-party that a program may have redirected traffic to a malicious domain. Which Falcon page will assist you in searching for any domain request information related to this notice?

Falcon X

Investigate

Discover

Spotlight

NO.23 Which of the following tactic and technique combinations is sourced from MITRE ATT&CK information?

Falcon Intel via Intelligence Indicator – Domain

Machine Learning via Cloud-Based ML

Malware via PUP

Credential Access via OS Credential Dumping

NO.24 Which statement is TRUE regarding the “Bulk Domains” search?

It will show a list of computers and process that performed a lookup of any of the domains in your search

The “Bulk Domains” search will allow you to blocklist your queried domains

The “Bulk Domains” search will show IP address and port information for any associated connectionsD.You should only pivot to the “Bulk Domains” search tool after completing an investigation

NO.25 When looking at the details of a detection, there are two fields called Global Prevalence and Local Prevalence.
Which answer best defines Local Prevalence?

Local prevalence is the frequency with which the hash of the triggering file is seen across the entire Internet

Local Prevalence tells you how common the hash of the triggering file is within your environment (CID)

Local Prevalence is the Virus Total score for the hash of the triggering file

Local prevalence is the frequency with which the hash of the triggering file is seen across all CrowdStrike customer environments

NO.26 The primary purpose for running a Hash Search is to:

determine any network connections

review the processes involved with a detection

determine the origin of the detection

review information surrounding a hash’s related activity

NO.27 What happens when you open the full detection details?

Theprocess explorer opens and the detection is removed from the console

The process explorer opens and you’re able to view the processes and process relationships

The process explorer opens and the detection copies to the clipboard

The process explorer opens and the Event Search query is run for the detection

NO.28 You are reviewing the raw data in an event search from a detection tree. You find a FileOpenlnfo event and want to find out if any other files were opened by the responsible process. Which two field values do you need from this event to perform a Process Timeline search?

ParentProcessld_decimal and aid

ResponsibleProcessld_decimal and aid

ContextProcessld_decimal and aid

TargetProcessld_decimal and aid

NO.29 From the Detections page, how can you view ‘in-progress’ detections assigned to Falcon Analyst Alex?

Filter on’Analyst: Alex’

Alex does not have the correct role permissions as a Falcon Analyst to be assigned detections

Filter on ‘Hostname: Alex’ and ‘Status: In-Progress’

Filter on ‘Status: In-Progress’ and ‘Assigned-to: Alex*

NO.30 When examining raw event data, what is the purpose of the field called ParentProcessld_decimal?

It contains an internal value not useful for an investigation

It contains the TargetProcessld_decimal value of the child process

It contains the Sensorld_decimal value for related events

It contains the TargetProcessld_decimal of the parent process

NO.31 What information does the MITRE ATT&CKFramework provide?

It provides best practices for different cybersecurity domains, such as Identify and Access Management

It provides a step-by-step cyber incident response strategy

It provides the phases of an adversary’s lifecycle, the platforms they are known to attack, and the specific methods they use

It is a system that attributes an attack techniques to a specific threat actor

NO.32 The Falcon platform will show a maximum of how many detections per day for a single Agent Identifier (AID)?

500

750

1000

1200

NO.33 How long does detection data remain in the CrowdStrike Cloud before purging begins?

90 Days

45 Days

14 Days

30 Days

NO.34 How are processes on the same plane ordered (bottom ‘VMTOOLSD.EXE’ to top CMD.EXE’)?

Process ID (Descending, highest on bottom)

Time started (Descending, most recent on bottom)

Time started (Ascending, most recent on top)

Process ID (Ascending, highest on top)

NO.35 In the “Full Detection Details”, which view will provide an exportable text listing of events like DNS requests.
Registry Operations, and Network Operations?

Thedata is unable to be exported

View as Process Tree

View as Process Timeline

View as Process Activity

NO.36 When examining a raw DNS request event, you see a field called ContextProcessld_decimal. What is the purpose of that field?

It contains the TargetProcessld_decimal value for other related events

It contains an internal value not useful for an investigation

It contains the ContextProcessld_decimal value for the parent process that made the DNS request

It contains the TargetProcessld_decimal value for the process that made the DNS request

NO.37 Which of the following is an example of a MITRE ATT&CK tactic?

Eternal Blue

Defense Evasion

Emotet

Phishing

NO.38 A list of managed and unmanaged neighbors for an endpoint can be found:

by using Hosts page in the Investigate tool

by reviewing “Groups” in Host Management under the Hosts page

under “Audit” by running Sensor Visibility Exclusions Audit

only by searching event data using Event Search

NO.39 What does the Full Detection Details option provide?

It provides a visualization of program ancestry via the Process Tree View

It provides a visualization of program ancestry via the Process Activity View

It provides detailed list of detection events via the Process Table View

It provides a detailed list of detection events via the Process Tree View

NO.40 How long does detection data remain in the CrowdStrike Cloud before purging begins?

90 Days

45 Days

30 Days

14 Days

NO.41 You receive an email from a third-party vendor that one of their services is compromised,thevendor names a specific IP address that the compromised service was using. Where would you input this indicator to find any activity related to this IP address?

IP Addresses

Remote or Network Logon Activity

Remote Access Graph

Hash Executions