Summer Sale Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: xmas50

CrowdStrike CCFR-201b - CrowdStrike Certified Falcon Responder

CrowdStrike CCFR-201b Premium Access     Download Demo    
Page: 6 / 6
Total 209 questions

CrowdStrike supports various deployment types. What is a ' POD sensor ' ?

A.

A sensor specifically designed for mobile devices (iOS/Android).

B.

A sensor that is installed directly on a Kubernetes or Docker host to monitor containers.

C.

A legacy sensor used only for disconnected or air-gapped systems.

D.

A physical appliance that sits on the network to monitor traffic.

From the Detections page, how can you view ' in-progress ' detections assigned to Falcon Analyst Alex?

A.

Filter on ' Analyst: Alex '

B.

Alex does not have the correct role permissions as a Falcon Analyst to be assigned detections

C.

Filter on ' Hostname: Alex ' and ' Status: In-Progress '

D.

Filter on ' Status: In-Progress ' and ' Assigned-to: Alex*

A list of managed and unmanaged neighbors for an endpoint can be found:

A.

by using Hosts page in the Investigate tool

B.

by reviewing " Groups " in Host Management under the Hosts page

C.

under " Audit " by running Sensor Visibility Exclusions Audit

D.

only by searching event data using Event Search

When reviewing a Host Timeline, which of the following filters is available?

A.

Severity

B.

Event Types

C.

User Name

D.

Detection ID

Which of the following sentences best describes the technical visibility provided by the ' Host Timeline ' view?

A.

A list of every time a user has logged in or out of the machine.

B.

Every host-relevant event (Process, File, Registry, Network) recorded in a given timeframe.

C.

A history of every hardware change or driver update on the endpoint.

D.

A log of every time the Falcon sensor was updated or restarted.

A responder decides to set a specific Custom IOA to the ' Monitor ' action. Which of the following sentences best describes the technical result of this choice?

A.

The sensor will block the activity and alert the user with a pop-up.

B.

The sensor will create detections with ' Informational ' severity but will not block the activity.

C.

The sensor will log the activity in the audit logs but will not generate a detection.

D.

The sensor will automatically isolate the host from the network.

According to the Falcon Overwatch Best Practice workflow, what is the required next step after a responder completes the ' Understand the process(es) involved ' step?

A.

Isolate the host to prevent lateral movement.

B.

Examine what is normal for the system to identify deviations.

C.

Delete the malicious file from the endpoint.

D.

Pivot to the Intelligence dashboard for actor attribution.

Which of the following subtitles/sub-views cannot be seen in the results of a ' Hash Search ' ?

A.

File Metadata

B.

Process Timeline

C.

Intel Indicators

D.

Execution History

Following a detection involving a suspected ransomware binary, the Falcon sensor automatically takes a prevention action to prevent the file from executing. An analyst needs to retrieve this file for local sandbox analysis. Considering the default configuration, for how many days will this file remain stored in the encrypted quarantine folder on the local endpoint?

A.

7 days

B.

14 days

C.

30 days

D.

90 days