Pre-Winter Sale Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: xmas50

CrowdStrike CCFR-201b - CrowdStrike Certified Falcon Responder

CrowdStrike CCFR-201b Premium Access     Download Demo    
Page: 5 / 7
Total 209 questions

To ensure that a malicious file cannot be accidentally executed or accessed by other processes, how are quarantined files stored on the local endpoints?

A.

They are hidden within the Windows System32 directory.

B.

They are stored in an encrypted format.

C.

They are renamed with a random 32-character extension.

D.

They are moved to a password-protected ZIP file on the desktop.

Responders often need to organize detections to identify trends across the environment. Which of the following is NOT a grouping option currently available on the ' Endpoint Detections ' page?

A.

Grouped by Process

B.

Grouped by Alert

C.

Grouped by File Path

D.

Grouped by Severity

A responder is analyzing a process tree where a suspicious executable is listed as a direct child of services.exe. In this scenario, which source is most likely responsible for the execution?

A.

An interactive user login via RDP.

B.

A Windows Service or a process launched by the Service Control Manager.

C.

A web browser download initiated by the end user.

D.

A script executed directly from a removable USB drive.

After running an Event Search, you can select many Event Actions depending on your results. Which of the following is NOT an option for any Event Action?

A.

Draw Process Explorer

B.

Show a +/- 10-minute window of events

C.

Show a Process Timeline for the responsible process

D.

Show Associated Event Data (from TargetProcessld_decimal or ContextProcessld_decimal)

The Bulk Domain Search tool contains Domain information along with which of the following?

A.

Process Information

B.

Port Information

C.

IP Lookup Information

D.

Threat Actor Information

A responder is explaining the quarantine process to a system administrator. What happens technically when a file is quarantined by the Falcon sensor?

A.

It is deleted from the disk and a log is sent to the cloud.

B.

It is moved to the CrowdStrike Cloud and removed from the local host immediately.

C.

It is compressed, password protected, and moved to the Quarantine folder on the endpoint.

D.

It is renamed to a .tmp extension and moved to the Windows Recycle Bin.

While reviewing the ' Detection Method ' field for a high-severity alert, a responder sees the label ' Post-Exploit ' . This terminology is used by CrowdStrike to identify a specific:

A.

Falcon Detection Method

B.

MITRE Tactic

C.

Indicator of Attack (IOA)

D.

Prevention Policy Level

What information does the MITRE ATT AND CK Framework provide?

A.

It provides best practices for different cybersecurity domains, such as Identify and Access Management

B.

It provides a step-by-step cyber incident response strategy

C.

It provides the phases of an adversary ' s lifecycle, the platforms they are known to attack, and the specific methods they use

D.

It is a system that attributes an attack techniques to a specific threat actor

While in an Event Search, a responder clicks on an event action. What does the ' Show Child Processes ' event action do?

A.

It displays a list of children in a new graphical tree.

B.

It generates a new Event Search based on the specific Event Action and Parent PID.

C.

It automatically terminates all children of that process on the endpoint.

D.

It pivots to the Host Search for the machine where the process ran.

Within the context of CrowdStrike’s behavioral detection engine, what does the acronym ' IOA ' stand for?

A.

Indicator of Activity

B.

Indicator of Attack

C.

Integrated Operation Alert

D.

Internal Objective Analysis