CCFR-201 Exam Questions – Real & Updated Questions PDF [Q22-Q43]

4.5/5 - (4 votes)

CCFR-201 Exam Questions – Real & Updated Questions PDF

Pass Guaranteed Quiz 2024 Realistic Verified Free CrowdStrike

NEW QUESTION 22
What happens when a hash is set to Always Block through IOC Management?

Execution is prevented on all hosts by default

Execution is prevented on selected host groups

Execution is prevented and detection alerts are suppressed

The hash is submitted for approval to be blocked from execution once confirmed by Falcon specialists

NEW QUESTION 23
When you configure and apply an IOA exclusion, what impact does it have on the host and what you see in the console?

The process specified is not sent to the Falcon Sandbox for analysis

The associated detection will be suppressed and the associated process would have been allowed to run

The sensor will stop sending events from the process specified in the regex pattern

The associated IOA will still generate a detection but the associated process would have been allowed to run

NEW QUESTION 24
You notice that taskeng.exe is one of the processes involved in a detection. What activity should you investigate next?

User logons after the detection

Executions of schtasks.exe after the detection

Scheduled tasks registered prior to the detection

Pivot to a Hash search for taskeng.exe

NEW QUESTION 25
Which is TRUE regarding a file released from quarantine?

It is allowed to execute on all hosts

It is deleted

No executions are allowed for 14 days after release

It will not generate future machine learning detections on the associated host

NEW QUESTION 26
From a detection, what is the fastest way to see children and sibling process information?

Select the Event Search option. Then from the Event Actions, select Show Associated Event Data (From TargetProcessld_decimal)

Select Full Detection Details from the detection

Right-click the process and select “Follow Process Chain”

Select the Process Timeline feature, enter the AID. Target Process ID, and Parent Process ID

NEW QUESTION 27
You are notified by a third-party that a program may have redirected traffic to a malicious domain. Which Falcon page will assist you in searching for any domain request information related to this notice?

Falcon X

Investigate

Discover

Spotlight

NEW QUESTION 28
Which of the following is NOT a filter available on the Detections page?

Severity

CrowdScore

Time

Triggering File

NEW QUESTION 29
What is the difference between a Host Search and a Host Timeline?

Results from a Host Search return information in an organized view by type, while a Host Timeline returns a view of all events recorded by the sensor

A Host Timeline only includes process execution events and user account activity

Results from a Host Timeline include process executions and related events organized by data type. A Host Search returns a temporal view of all events for the given host

There is no difference – Host Search and Host Timeline are different names for the same search page

NEW QUESTION 30
A list of managed and unmanaged neighbors for an endpoint can be found:

by using Hosts page in the Investigate tool

by reviewing “Groups” in Host Management under the Hosts page

under “Audit” by running Sensor Visibility Exclusions Audit

only by searching event data using Event Search

NEW QUESTION 31
Within the MITRE-Based Falcon Detections Framework, what is the correct way to interpret Keep Access > Persistence > Create Account?

An adversary is trying to keep access through persistence by creating an account

An adversary is trying to keep access through persistence using browser extensions

An adversary is trying to keep access through persistence using external remote services

adversary is trying to keep access through persistence using application skimming

NEW QUESTION 32
When analyzing an executable with a global prevalence of common; but you do not know what the executable is. what is the best course of action?

Do nothing, as this file is common and well known

From detection, click the VT Hash button to pivot to VirusTotal to investigate further

From detection, use API manager to create a custom blocklist

From detection, submit to FalconX for deep dive analysis

NEW QUESTION 33
What is an advantage of using a Process Timeline?

Process related events can be filtered to display specific event types

Suspicious processes are color-coded based on their frequency and legitimacy over time

Processes responsible for spikes in CPU performance are displayed overtime

A visual representation of Parent-Child and Sibling process relationships is provided

NEW QUESTION 34
Which option indicates a hash is allowlisted?

No Action

Allow

Ignore

Always Block

NEW QUESTION 35
What information does the MITRE ATT&CKFramework provide?

It provides best practices for different cybersecurity domains, such as Identify and Access Management

It provides a step-by-step cyber incident response strategy

It provides the phases of an adversary’s lifecycle, the platforms they are known to attack, and the specific methods they use

It is a system that attributes an attack techniques to a specific threat actor

NEW QUESTION 36
Where can you find hosts that are in Reduced Functionality Mode?

Event Search

Executive Summary dashboard

Host Search

Installation Tokens

NEW QUESTION 37
What happens when a quarantined file is released?

It is moved into theC:CrowdStrikeQuarantineReleasedfolder on the host

It is allowed to execute on the host

It is deleted

It is allowed to execute on all hosts

NEW QUESTION 38
What happens when a hash is allowlisted?

Execution is prevented, but detection alerts are suppressed

Execution is allowed on all hosts, including all other Falcon customers

The hash is submitted for approval to be allowed to execute once confirmed by Falcon specialists

Execution is allowed on all hosts that fall under the organization’s CID

NEW QUESTION 39
How long does detection data remain in the CrowdStrike Cloud before purging begins?

90 Days

45 Days

30 Days

14 Days

NEW QUESTION 40
What does pivoting to an Event Search from a detection do?

It gives you the ability to search for similar events on other endpoints quickly

It takes you to the raw Insight event data and provides you with a number of Event Actions

It takes you to a Process Timeline for that detection so you can see all related events

It allows you to input an event type, such as DNS Request or ASEP write, and search for those events within the detection

NEW QUESTION 41
Where are quarantined files stored on Windows hosts?

WindowsQuarantine

WindowsSystem32DriversCrowdStrikeQuarantine

WindowsSystem32

WindowstempDriversCrowdStrikeQuarantine

NEW QUESTION 42
When looking at the details of a detection, there are two fields called Global Prevalence and Local Prevalence.
Which answer best defines Local Prevalence?

Local prevalence is the frequency with which the hash of the triggering file is seen across the entire Internet

Local Prevalence tells you how common the hash of the triggering file is within your environment (CID)

Local Prevalence is the Virus Total score for the hash of the triggering file

Local prevalence is the frequency with which the hash of the triggering file is seen across all CrowdStrike customer environments

NEW QUESTION 43
After pivoting to an event search from a detection, you locate the ProcessRollup2 event. Which two field values are you required to obtain to perform a Process Timeline search so you can determine what the process was doing?

SHA256 and TargetProcessld_decimal

SHA256 and ParentProcessld_decimal

aid and ParentProcessld_decimal

aid and TargetProcessld_decimal