Pre-Winter Sale Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: xmas50

CrowdStrike CCFR-201b - CrowdStrike Certified Falcon Responder

CrowdStrike CCFR-201b Premium Access     Download Demo    
Page: 4 / 7
Total 209 questions

What action is needed to ensure Falcon does not block or generate a detection for a process by using the file hash?

A.

Create a Custom IOC with an action of allow for the hash

B.

Create a Machine Learning Exclusion with an action of allow for the hash

C.

Create a Custom IOA with an action of allow for the hash

D.

Create an IOA Exclusion with an action of allow for the hash

CrowdStrike supports various deployment types. What is a ' POD sensor ' ?

A.

A sensor specifically designed for mobile devices (iOS/Android).

B.

A sensor that is installed directly on a Kubernetes or Docker host to monitor containers.

C.

A legacy sensor used only for disconnected or air-gapped systems.

D.

A physical appliance that sits on the network to monitor traffic.

Where are quarantined files stored on Windows hosts?

A.

Windows\Quarantine

B.

Windows\System32\Drivers\CrowdStrike\Quarantine

C.

Windows\System32\

D.

Windows\temp\Drivers\CrowdStrike\Quarantine

What does the Full Detection Details option provide?

A.

It provides a visualization of program ancestry via the Process Tree View

B.

It provides a visualization of program ancestry via the Process Activity View

C.

It provides detailed list of detection events via the Process Table View

D.

It provides a detailed list of detection events via the Process Tree View

Executive dashboards provide a high-level view of security. Which of the following CANNOT be seen from the Executive Summary Dashboard?

A.

Detections broken down by Tactic.

B.

A breakdown of Agent Versions across the fleet.

C.

The top 10 hosts with the most detections.

D.

The organization’s current CrowdScore trend.

When reviewing a Host Timeline, which of the following filters is available?

A.

Severity

B.

Event Types

C.

User Name

D.

Detection ID

Data retention is a key factor in retrospective hunting. How long will " Detection Related Events " be retained in the Falcon environment?

A.

30 days

B.

60 days

C.

90 days

D.

1 year

What information is contained within a Process Timeline?

A.

All cloudable process-related events within a given timeframe

B.

All cloudable events for a specific host

C.

Only detection process-related events within a given timeframe

D.

A view of activities on Mac or Linux hosts

How are processes on the same plane ordered (bottom ' VMTOOLSD.EXE ' to top CMD.EXE ' )?

A.

Process ID (Descending, highest on bottom)

B.

Time started (Descending, most recent on bottom)

C.

Time started (Ascending, most recent on top)

D.

Process ID (Ascending, highest on top)

During the triage of a detection involving a newly created persistent task, which specific indicator is most important for a responder to identify the actual intent of the service?

A.

The total CPU usage of the parent process.

B.

The command-line arguments used during the task creation.

C.

The Agent ID (AID) of the host where the detection fired.

D.

The physical location of the endpoint in the office.