CrowdStrike Certified Falcon Responder - CCFR-201b FREE EXAM DUMPS QUESTIONS & ANSWERS]

Question 1

Falcon uses specific identifiers to track processes across the environment. Which of the following sentences best describes what the ' TargetProcessId_decimal ' raw data represents?

A. The memory address where the process's executable is loaded. B. The standard Process ID (PID) assigned by the Windows operating system. C. A sensor-assigned decimal number that is unique for each process across time and hosts. D. The total number of seconds the process has been running.

Discussion 0

Correct Answer: C Vote an answer

Question 2

What actions are available for domain name-based Indicators of Compromise (IOCs) in Falcon?

A. Block
Detect only
Allow B. Detect only
Allow C. Block
Allow
No action D. Detect only
No action

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 3

From a detection, what is the fastest way to see children and sibling process information?

A. Select Full Detection Details from the detection B. Right-click the process and select " Follow Process Chain " C. Select the Event Search option. Then from the Event Actions, select Show Associated Event Data (From TargetProcessld_decimal) D. Select the Process Timeline feature, enter the AID. Target Process ID, and Parent Process ID

Discussion 0

Correct Answer: A Vote an answer

Question 4

Filtering is essential for managing a high volume of alerts. Which of the following filters is available by default within the ' Endpoint Detections ' dashboard to help narrow down specific threats?

A. Triggering File B. Local Subnet Mask C. Hardware BIOS Version D. Sensor Update Policy Name

Discussion 0

Correct Answer: A Vote an answer

Question 5

When reviewing open detections, what method should be used to identify the most relevant related information in the environment?

A. Review the Detection Resolutions dashboard B. Host Management grouping by host, organizational unit, or prevention policy C. Grouping detections by command line, host, hash, or triggering file D. Sort detections by Time: Oldest to Newest

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 6

While reviewing the ' Detection Method ' field for a high-severity alert, a responder sees the label ' Post- Exploit ' . This terminology is used by CrowdStrike to identify a specific:

A. Prevention Policy Level B. Falcon Detection Method C. Indicator of Attack (IOA) D. MITRE Tactic

Discussion 0

Correct Answer: B Vote an answer

Question 7

Refer to the image.

In the Full Detection View while viewing the Process Tree you see an attack outlined as in the image above.
Based on what you see, what happened during the attack?

A. The attacker launched a command prompt, renamed binaries, executed malware, and prepared exfiltration B. The attacker executed malware, renamed binaries, prepared exfiltration, and deleted backups to prevent recovery C. The attacker launched a command prompt to establish a reverse shell to grant remote code execution capabilities D. The attacker launched a command prompt, enumerated the host, created persistence, and deleted backups to prevent recovery

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).

Question 8

Depending on the subscription level, " Cloudable Events " (standard telemetry) have a specific retention period. What is the minimum period of time that these events are retained?

A. 1 day B. 7 days C. 14 days D. 30 days

Discussion 0

Correct Answer: B Vote an answer

Question 9

To manage the lifecycle of security incidents and review new alerts, a responder must navigate through the Falcon sidebar to which specific location?

A. Endpoint Security > Monitor > Endpoint Detections B. Investigate > Host Search > Alerts C. Configuration > Security Policies > Detections D. Dashboards > Global Activity > Security Alerts

Discussion 0

Correct Answer: A Vote an answer