CCFR-201 CrowdStrike Certified Falcon Responder Exam Dumps

dumps2023-10-23T09:47:01+08:00

CCFR-201 CrowdStrike Certified Falcon Responder exam information is useful for you to study. There are 60 questions in the real CrowdStrike CCFR-201 exam, and you have 90 minutes to answer all the questions. The CrowdStrike Certified Falcon Responder (CCFR) exam is the final step toward the completion of CCFR certification. This CCFR-201 exam evaluates your knowledge, skills and abilities to respond to a detection within the CrowdStrike Falcon console. We provide the latest CCFR-201 exam dumps, which are valuable in your preparation. Free CrowdStrike Certification CCFR-201 exam dumps are below.

Page 1 of 2

1. After pivoting to an event search from a detection, you locate the ProcessRollup2 event.

Which two field values are you required to obtain to perform a Process Timeline search so you can determine what the process was doing?

SHA256 and TargetProcessld_decimal

SHA256 and ParentProcessld_decimal

aid and ParentProcessld_decimal

aid and TargetProcessld_decimal

2. The function of Machine Learning Exclusions is to___________.

stop all detections for a specific pattern ID

stop all sensor data collection for the matching path(s)

Stop all Machine Learning Preventions but a detection will still be generated and files will still be uploaded to the CrowdStrike Cloud

stop all ML-based detections and preventions for the matching path(s) and/or stop files from being uploaded to the CrowdStrike Cloud

3. What happens when you create a Sensor Visibility Exclusion for a trusted file path?

It excludes host information from Detections and Incidents generated within that file path location

It prevents file uploads to the CrowdStrike cloud from that file path

It excludes sensor monitoring and event collection for the trusted file path

It disables detection generation from that path, however the sensor can still perform prevention actions

4. What types of events are returned by a Process Timeline?

Only detection events

All cloudable events

Only process events

Only network events

5. What is the difference between a Host Search and a Host Timeline?

Results from a Host Search return information in an organized view by type, while a Host Timeline returns a view of all events recorded by the sensor

A Host Timeline only includes process execution events and user account activity

Results from a Host Timeline include process executions and related events organized by data type. A Host Search returns a temporal view of all events for the given host

There is no difference - Host Search and Host Timeline are different names for the same search page

6. When examining raw event data, what is the purpose of the field called ParentProcessld_decimal?

It contains an internal value not useful for an investigation

It contains the TargetProcessld_decimal value of the child process

It contains the Sensorld_decimal value for related events

It contains the TargetProcessld_decimal of the parent process

7. What action is used when you want to save a prevention hash for later use?

Always Block

Never Block

Always Allow

No Action

8. A list of managed and unmanaged neighbors for an endpoint can be found:

by using Hosts page in the Investigate tool

by reviewing "Groups" in Host Management under the Hosts page

under "Audit" by running Sensor Visibility Exclusions Audit

only by searching event data using Event Search

9. What happens when a hash is allowlisted?

Execution is prevented, but detection alerts are suppressed

Execution is allowed on all hosts, including all other Falcon customers

The hash is submitted for approval to be allowed to execute once confirmed by Falcon specialists

Execution is allowed on all hosts that fall under the organization's CID

10. Which of the following is returned from the IP Search tool?

IP Summary information from Falcon events containing the given IP

Threat Graph Data for the given IP from Falcon sensors

Unmanaged host data from system ARP tables for the given IP

IP Detection Summary information for detection events containing the given IP

Page 2 of 2

11. Which is TRUE regarding a file released from quarantine?

No executions are allowed for 14 days after release

It is allowed to execute on all hosts

It is deleted

It will not generate future machine learning detections on the associated host

12. Which of the following is an example of a MITRE ATT&CK tactic?

Eternal Blue

Defense Evasion

Emotet

Phishing

13. You notice that taskeng.exe is one of the processes involved in a detection.

What activity should you investigate next?

User logons after the detection

Executions of schtasks.exe after the detection

Scheduled tasks registered prior to the detection

Pivot to a Hash search for taskeng.exe

14. Where can you find hosts that are in Reduced Functionality Mode?

Event Search

Executive Summary dashboard

Host Search

Installation Tokens

15. From the Detections page, how can you view 'in-progress' detections assigned to Falcon Analyst Alex?

Filter on'Analyst: Alex'

Alex does not have the correct role permissions as a Falcon Analyst to be assigned detections

Filter on 'Hostname: Alex' and 'Status: In-Progress'

Filter on 'Status: In-Progress' and 'Assigned-to: Alex*

16. The Process Activity View provides a rows-and-columns style view of the events generated in a detection.

Why might this be helpful?

The Process Activity View creates a consolidated view of all detection events for that process that can be exported for further analysis

The Process Activity View will show the Detection time of the earliest recorded activity which might indicate first affected machine

The Process Activity View only creates a summary of Dynamic Link Libraries (DLLs) loaded by a process

The Process Activity View creates a count of event types only, which can be useful when scoping the event

17. After running an Event Search, you can select many Event Actions depending on your results.

Which of the following is NOT an option for any Event Action?

Draw Process Explorer

Show a +/- 10-minute window of events

Show a Process Timeline for the responsible process

Show Associated Event Data (from TargetProcessld_decimal or ContextProcessld_decimal)

18. Which option indicates a hash is allowlisted?

No Action

Allow

Ignore

Always Block

CCFR-201 CrowdStrike Certified Falcon Responder Exam Dumps

CCFR-201 CrowdStrike Certified Falcon Responder Exam Dumps

Share this post

Leave a Reply Cancel reply

Related Posts

CrowdStrike Certified Falcon Hunter CCFH-202 Exam Dumps

New CrowdStrike Certified Falcon Administrator CCFA Dumps CCFA-200 Exam Questions