Labour Day Special 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: exams65

CrowdStrike Certified Falcon Responder Question and Answers

CrowdStrike Certified Falcon Responder

Last Update Apr 26, 2024
Total Questions : 60

We are offering FREE CCFR-201 CrowdStrike exam questions. All you do is to just go and sign up. Give your details, prepare CCFR-201 free exam questions and then go for complete pool of CrowdStrike Certified Falcon Responder test questions that will help you more.

CCFR-201 pdf

CCFR-201 PDF

$35  $99.99
 Add to Cart
CCFR-201 Engine

CCFR-201 Testing Engine

$42  $119.99
 Add to Cart
CCFR-201 PDF + Engine

CCFR-201 PDF + Testing Engine

$56  $159.99
 Add to Cart
Questions 1

Where are quarantined files stored on Windows hosts?

Options:

A.  

Windows\Quarantine

B.  

Windows\System32\Drivers\CrowdStrike\Quarantine

C.  

Windows\System32\

D.  

Windows\temp\Drivers\CrowdStrike\Quarantine

Discussion 0
Questions 2

A list of managed and unmanaged neighbors for an endpoint can be found:

Options:

A.  

by using Hosts page in the Investigate tool

B.  

by reviewing "Groups" in Host Management under the Hosts page

C.  

under "Audit" by running Sensor Visibility Exclusions Audit

D.  

only by searching event data using Event Search

Discussion 0
Questions 3

Which of the following is NOT a filter available on the Detections page?

Options:

A.  

Severity

B.  

CrowdScore

C.  

Time

D.  

Triggering File

Discussion 0
Questions 4

When analyzing an executable with a global prevalence of common; but you do not know what the executable is. what is the best course of action?

Options:

A.  

Do nothing, as this file is common and well known

B.  

From detection, click the VT Hash button to pivot to VirusTotal to investigate further

C.  

From detection, use API manager to create a custom blocklist

D.  

From detection, submit to FalconX for deep dive analysis

Discussion 0
Questions 5

What does the Full Detection Details option provide?

Options:

A.  

It provides a visualization of program ancestry via the Process Tree View

B.  

It provides a visualization of program ancestry via the Process Activity View

C.  

It provides detailed list of detection events via the Process Table View

D.  

It provides a detailed list of detection events via the Process Tree View

Discussion 0
Questions 6

When looking at the details of a detection, there are two fields called Global Prevalence and Local Prevalence. Which answer best defines Local Prevalence?

Options:

A.  

Local prevalence is the frequency with which the hash of the triggering file is seen across the entire Internet

B.  

Local Prevalence tells you how common the hash of the triggering file is within your environment (CID)

C.  

Local Prevalence is the Virus Total score for the hash of the triggering file

D.  

Local prevalence is the frequency with which the hash of the triggering file is seen across all CrowdStrike customer environments

Discussion 0
Questions 7

You receive an email from a third-party vendor that one of their services is compromised,thevendor names a specific IP address that the compromised service was using. Where would you input this indicator to find any activity related to this IP address?

Options:

A.  

IP Addresses

B.  

Remote or Network Logon Activity

C.  

Remote Access Graph

D.  

Hash Executions

Discussion 0
Questions 8

The Bulk Domain Search tool contains Domain information along with which of the following?

Options:

A.  

Process Information

B.  

Port Information

C.  

IP Lookup Information

D.  

Threat Actor Information

Discussion 0
Questions 9

Which of the following is an example of a MITRE ATT&CK tactic?

Options:

A.  

Eternal Blue

B.  

Defense Evasion

C.  

Emotet

D.  

Phishing

Discussion 0
Questions 10

What are Event Actions?

Options:

A.  

Automated searches that can be used to pivot between related events and searches

B.  

Pivotable hyperlinks available in a Host Search

C.  

Custom event data queries bookmarked by the currently signed in Falcon user

D.  

Raw Falcon event data

Discussion 0
Questions 11

Which Executive Summary dashboard item indicates sensors running with unsupported versions?

Options:

A.  

Detections by Severity

B.  

Inactive Sensors

C.  

Sensors in RFM

D.  

Active Sensors

Discussion 0
Questions 12

From the Detections page, how can you view 'in-progress' detections assigned to Falcon Analyst Alex?

Options:

A.  

Filter on'Analyst: Alex'

B.  

Alex does not have the correct role permissions as a Falcon Analyst to be assigned detections

C.  

Filter on 'Hostname: Alex' and 'Status: In-Progress'

D.  

Filter on 'Status: In-Progress' and 'Assigned-to: Alex*

Discussion 0
Questions 13

The Falcon platform will show a maximum of how many detections per day for a single Agent Identifier (AID)?

Options:

A.  

500

B.  

750

C.  

1000

D.  

1200

Discussion 0
Questions 14

When you configure and apply an IOA exclusion, what impact does it have on the host and what you see in the console?

Options:

A.  

The process specified is not sent to the Falcon Sandbox for analysis

B.  

The associated detection will be suppressed and the associated process would have been allowed to run

C.  

The sensor will stop sending events from the process specified in the regex pattern

D.  

The associated IOA will still generate a detection but the associated process would have been allowed to run

Discussion 0
Questions 15

You can jump to a Process Timeline from many views, like a Hash Search, by clicking which of the following?

Options:

A.  

ProcessTimeline Link

B.  

PID

C.  

UTCtime

D.  

Process ID or Parent Process ID

Discussion 0
Questions 16

What happens when you create a Sensor Visibility Exclusion for a trusted file path?

Options:

A.  

It excludes host information from Detections and Incidents generated within that file path location

B.  

It prevents file uploads to the CrowdStrike cloud from that file path

C.  

It excludes sensor monitoring and event collection for the trusted file path

D.  

It disables detection generation from that path, however the sensor can still perform prevention actions

Discussion 0
Questions 17

After running an Event Search, you can select many Event Actions depending on your results. Which of the following is NOT an option for any Event Action?

Options:

A.  

Draw Process Explorer

B.  

Show a +/- 10-minute window of events

C.  

Show a Process Timeline for the responsible process

D.  

Show Associated Event Data (from TargetProcessld_decimal or ContextProcessld_decimal)

Discussion 0
Questions 18

What happens when a quarantined file is released?

Options:

A.  

It is moved into theC:\CrowdStrike\Quarantine\Releasedfolder on the host

B.  

It is allowed to execute on the host

C.  

It is deleted

D.  

It is allowed to execute on all hosts

Discussion 0