Weekend Sale Special - 75% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: newyear

CrowdStrike CCFR-201b - CrowdStrike Certified Falcon Responder

CrowdStrike CCFR-201b Premium Access     Download Demo    
Page: 2 / 7
Total 209 questions

What do IOA exclusions help you achieve?

A.

Reduce false positives based on Next-Gen Antivirus settings in the Prevention Policy

B.

Reduce false positives of behavioral detections from IOA based detections only

C.

Reduce false positives of behavioral detections from IOA based detections based on a file hash

D.

Reduce false positives of behavioral detections from Custom IOA and OverWatch detections only

When reviewing open detections, what method should be used to identify the most relevant related information in the environment?

A.

Host Management grouping by host, organizational unit, or prevention policy

B.

Grouping detections by command line, host, hash, or triggering file

C.

Review the Detection Resolutions dashboard

D.

Sort detections by Time: Oldest to Newest

Host Search is a powerful investigation tool. From which of the following sources is a responder most likely to pivot directly to a Host Search?

A.

A global intelligence report about a new adversary.

B.

A specific detection that occurred on a particular host.

C.

The main settings menu of the Falcon console.

D.

The help documentation in the Support portal.

When a responder is looking at the ' Full Detection Details ' page, they can toggle between several views. Which of the following is NOT a layout option available for viewing these details?

A.

Graph View

B.

Tree View

C.

Process Timeline

D.

List View

When reviewing the data within a process timeline, what specific type of information is being displayed to the responder?

A.

A capture of all raw network packets sent by the process.

B.

All cloudable process-related events (files written, network connections, etc.) for that process in a given timeframe.

C.

A list of every user who has ever logged into that specific endpoint.

D.

A summary of the hardware performance metrics during the time of the detection.

Which of the following sentences best describes the primary use of ' Retrospective Analysis ' ?

A.

Identifying future threats using predictive AI models.

B.

Applying an investigative approach across historical timed buckets of telemetry to find past activity.

C.

Terminating a malicious process as it starts to execute.

D.

Recovering files that were encrypted by a ransomware attack.

You receive an email from a third-party vendor that one of their services is compromised,thevendor names a specific IP address that the compromised service was using. Where would you input this indicator to find any activity related to this IP address?

A.

IP Addresses

B.

Remote or Network Logon Activity

C.

Remote Access Graph

D.

Hash Executions

The primary purpose for running a Hash Search is to:

A.

determine any network connections

B.

review the processes involved with a detection

C.

determine the origin of the detection

D.

review information surrounding a hash ' s related activity

When an organization needs to detect a specific behavior that is unique to their environment, they can create a Custom IOA. Which of the following is NOT required when configuring a custom IOA from scratch?

A.

Selecting a Rule Type (e.g., Process Creation).

B.

Specifying the Severity level of the resulting detection.

C.

Assigning a specific host group to the IOA rule at the time of creation.

D.

Providing a unique name for the rule.

During a targeted investigation into a potentially compromised internal administrative account, a responder utilizes the User Search functionality within the Investigate menu. The goal is to identify if the account was leveraged to drop or launch unauthorized binaries across multiple systems in the environment. Which specific data category is natively visible in the User Search results to facilitate this check?

A.

Registry Key Operations

B.

Network File Transfer ports

C.

Unique Executables Written and Process Executions

D.

BIOS and Hardware modification logs