Pre-Winter Sale Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: xmas50

CrowdStrike CCFR-201b - CrowdStrike Certified Falcon Responder

CrowdStrike CCFR-201b Premium Access     Download Demo    
Page: 3 / 7
Total 209 questions

The ' Detection Resolutions ' dashboard helps track team performance. Which of the following CANNOT be seen from this dashboard?

A.

Average time to resolve a detection.

B.

Total number of detections resolved by each analyst.

C.

The top 10 hosts/users/files with the most detections.

D.

The breakdown of True Positive vs. False Positive resolutions.

Which option indicates a hash is allowlisted?

A.

No Action

B.

Allow

C.

Ignore

D.

Always Block

The Falcon sensor can take several automated actions to protect an endpoint. Which of the following is NOT an action that Falcon takes upon detection?

A.

Process Termination

B.

File Quarantine

C.

Process Restart

D.

Network Isolation

If the Falcon sensor identifies suspicious behavioral patterns—such as a process attempting to dump memory from lsass.exe—what specific type of detection will be generated?

A.

Indicator of Compromise (IOC)

B.

Indicator of Attack (IOA)

C.

Known Malware Alert

D.

Intelligence Data Match

The Falcon sensor can automatically upload quarantined files to the CrowdStrike Cloud for further analysis. What is the maximum size allowed for a quarantined file to be uploaded?

A.

10MB

B.

32MB

C.

64MB

D.

128MB

Bulk Search tools have several features in common. Which of the following is incorrect as a feature common to all Bulk Search types?

A.

They allow for searching multiple items (up to 500) at once.

B.

Regular Expressions (Regex) are allowed within the search fields.

C.

Search results can be exported for further analysis.

D.

They search across historical telemetry in the cloud.

Which of the following is NOT a valid event type?

A.

StartofProcess

B.

EndofProcess

C.

ProcessRollup2

D.

DnsRequest

An executive asks for a definition of ' CrowdScore ' . Which of the following sentences best describes what CrowdScore is?

A.

It is a ranking system that compares your organization’s security to other companies.

B.

It is a metric designed to show an organization ' s threat level on a continual basis by aggregating related detections.

C.

It is the total number of detections that have been resolved within the last 24 hours.

D.

It is a measure of the total processing power being used by the Falcon sensors globally.

The Falcon platform will show a maximum of how many detections per day for a single Agent Identifier (AID)?

A.

500

B.

750

C.

1000

D.

1200

To manage the lifecycle of security incidents and review new alerts, a responder must navigate through the Falcon sidebar to which specific location?

A.

Investigate > Host Search > Alerts

B.

Endpoint Security > Monitor > Endpoint Detections

C.

Configuration > Security Policies > Detections

D.

Dashboards > Global Activity > Security Alerts