CrowdStrike CCFR-201b - CrowdStrike Certified Falcon Responder

A SOC Manager is reviewing the monthly efficiency of the incident response team. They are specifically analyzing how many alerts were handled by each individual analyst and the ratio of legitimate threats to noise to optimize staffing levels. While navigating the Detection Resolutions Dashboard, which of the following metrics would they NOT find, as it is primarily located within the Activity or Executive summary dashboards?

The Falcon sensor can take several automated actions to protect an endpoint. Which of the following is NOT an action that Falcon takes upon detection?

During the triage of a detection involving a newly created persistent task, which specific indicator is most important for a responder to identify the actual intent of the service?

Which of the following sentences best describes the primary use of ' Retrospective Analysis ' ?

While most searches are accessible from a detection, some require a manual jump. Which search is not available as a direct pivot from a detection?

Refer to the image.

Within a Host Search, you have filtered for cmd.exe in the Process executions table and now need to pivot to a process timeline.

Which item in the table do you select to pivot to the Process Timeline?

What information does the MITRE ATT AND CK Framework provide?

Where are quarantine files located on a Mac Endpoint?

Falcon limits the number of detections displayed to prevent the UI from becoming overwhelmed. How many detections are displayed per day per Agent ID (AID)?

The Falcon sensor can automatically upload quarantined files to the CrowdStrike Cloud for further analysis. What is the maximum size allowed for a quarantined file to be uploaded?