Summer Sale Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: xmas50

CrowdStrike CCFR-201b - CrowdStrike Certified Falcon Responder

CrowdStrike CCFR-201b Premium Access     Download Demo    
Page: 1 / 7
Total 209 questions

A responder wants to verify why a certain quarantined file was not uploaded to the cloud. Which specific policy dictates whether quarantined files are permitted to be uploaded?

A.

Sensor Update Policy

B.

Prevention Policy

C.

Response Policy

D.

Quarantine Management Policy

What types of events are returned by a Process Timeline?

A.

Only detection events

B.

All cloudable events

C.

Only process events

D.

Only network events

During the configuration of a new IOA rule, the administrator must decide what action the sensor should take. Which of the following is NOT a valid IOA rule action?

A.

Monitor

B.

Block

C.

No Action

D.

Kill Process

Which is TRUE regarding a file released from quarantine?

A.

No executions are allowed for 14 days after release

B.

It is allowed to execute on all hosts

C.

It is deleted

D.

It will not generate future machine learning detections on the associated host

A responder decides to set a specific Custom IOA to the ' Monitor ' action. Which of the following sentences best describes the technical result of this choice?

A.

The sensor will block the activity and alert the user with a pop-up.

B.

The sensor will create detections with ' Informational ' severity but will not block the activity.

C.

The sensor will log the activity in the audit logs but will not generate a detection.

D.

The sensor will automatically isolate the host from the network.

What happens when a hash is set to Always Block through IOC Management?

A.

Execution is prevented on all hosts by default

B.

Execution is prevented on selected host groups

C.

Execution is prevented and detection alerts are suppressed

D.

The hash is submitted for approval to be blocked from execution once confirmed by Falcon specialists

You found a list of SHA256 hashes in an intelligence report and search for them using the Hash Execution Search. What can be determined from the results?

A.

Identifies a detailed list of all process executions for the specified hashes

B.

Identifies hosts that loaded or executed the specified hashes

C.

Identifies users associated with the specified hashes

D.

Identifies detections related to the specified hashes

How does a DNSRequest event link to its responsible process?

A.

Via both its ContextProcessld__decimal and ParentProcessld_decimal fields

B.

Via its ParentProcessld_decimal field

C.

Via its ContextProcessld_decimal field

D.

Via its TargetProcessld_decimal field

According to the Falcon Overwatch Best Practice workflow, what is the required next step after a responder completes the ' Understand the process(es) involved ' step?

A.

Isolate the host to prevent lateral movement.

B.

Examine what is normal for the system to identify deviations.

C.

Delete the malicious file from the endpoint.

D.

Pivot to the Intelligence dashboard for actor attribution.

Multiple detections with the process schtasks.exe begin to alert in the UI. The process executes the following command line on several unique hosts:

schtasks.exe /Query /TN " Qljsscdqr "

What is the most efficient way to identify which hosts are executing this scheduled task?

A.

Filter detections by command line and sort by ' Host:A to Z '

B.

Filter detections by command line and group by triggering file

C.

Filter detections by the triggering file and sort by ' Host:A to Z '

D.

Filter detections by command line and group by host