CrowdStrike CCFR-201b - CrowdStrike Certified Falcon Responder
In the Falcon console, detections can be automated or manual. Which of the following options represents a manual detection?
During the configuration of a new IOA rule, the administrator must decide what action the sensor should take. Which of the following is NOT a valid IOA rule action?
Data retention is a key factor in retrospective hunting. How long will " Detection Related Events " be retained in the Falcon environment?
An analyst wants to see the raw events behind a specific detection. Which icon in the UI allows them to pivot directly to an event search?
A responder is unsure about the difference between ' Detection ' and ' Prevention ' settings. Where can they find information about Detection and Prevention Policies?
In the Hash Search tool, which of the following is listed under Process Executions?
In the full detection tree view, icons provide visual cues about the telemetry. What does the specific icon representing a ' Falcon ' (blue bird) indicate to the responder?
When viewing the main ' Quarantine ' dashboard to manage blocked files, which of the following pieces of information CANNOT be seen by default?
A responder is looking at event telemetry and sees an event named ' ProcessRollup2 ' . Which sentence best describes what this event type represents?
While reviewing the high-level organizational structure of a complex detection in the Falcon console, a responder identifies several layers of activity. Which of the following is NOT officially recognized as an Objective Layer within the CrowdStrike detection hierarchy?
