CCFR-201b by CrowdStrike Valid Free Exam Practice Test

Question 1

You can jump to a Process Timeline from many views, like a Hash Search, by clicking which of the following?

A. UTCtime B. ProcessTimeline Link C. PID D. Process ID or Parent Process ID

Correct Answer: D

Question 2

A responder needs to categorize an incident based on the high-level goals of the attacker. Which of the following lists correctly identifies the " Objectives " as they are natively defined and used within the Falcon platform?

A. Explore, Keep Access, Gain Access, Falcon Detection Method, Contact Controlled systems, Follow Through B. Reconnaissance, Delivery, Weaponization, Exploitation, Installation, Command and Control C. Triage, Containment, Remediation, Eradication, Reporting, Recovery D. Identify, Protect, Detect, Respond, Recover, Lessons Learned

Correct Answer: A

Question 3

When investigating system-level persistence, it is critical to know what the services.exe process is responsible for. What is its primary function?

A. Managing user profiles and registry hives during login. B. Providing a graphical interface for the Windows Task Manager. C. Monitoring network traffic for potential data exfiltration. D. Launching and managing the lifecycle of system services.

Correct Answer: D

Question 4

Within the MITRE-Based Falcon Detections Framework, what is the correct way to interpret Keep Access > Persistence > Create Account?

A. An adversary is trying to keep access through persistence using external remote services B. adversary is trying to keep access through persistence using application skimming C. An adversary is trying to keep access through persistence by creating an account D. An adversary is trying to keep access through persistence using browser extensions

Correct Answer: C

Question 5

What action is needed to ensure Falcon does not block or generate a detection for a process by using the file hash?

A. Create a Custom IOA with an action of allow for the hash B. Create an IOA Exclusion with an action of allow for the hash C. Create a Machine Learning Exclusion with an action of allow for the hash D. Create a Custom IOC with an action of allow for the hash

Correct Answer: D

Explanation: Only visible for ExamsLabs members. You can sign-up / login (it's free).

Question 6

While the host timeline is comprehensive, some data is not included in that specific view. Which of the following CANNOT be seen directly from the host timeline?

A. PID (Process ID) B. Event Name C. CPU Temperature D. Timestamp

Correct Answer: C

Question 7

During the incident response process, a responder must update the status of a detection. Which of the following options is NOT a valid detection status recognized by the Falcon console?

A. In Progress B. True Positive C. New D. Complete

Correct Answer: D

Question 8

Which of the following tactic and technique combinations is sourced from MITRE ATT AND CK information?

A. Falcon Intel via Intelligence Indicator - Domain B. Machine Learning via Cloud-Based ML C. Malware via PUP D. Credential Access via OS Credential Dumping

Correct Answer: D

Question 9

Which of the following is NOT a filter available on the Detections page?

A. Time B. CrowdScore C. Triggering File D. Severity

Correct Answer: B

Question 10

When analyzing the raw telemetry for a ' DNSRequest ' event, which of the following raw data fields is available to the responder?

A. index B. browser_type C. cpu_usage_percent D. monitor_mode

Correct Answer: A

CrowdStrike Certified Falcon Responder - CCFR-201b Exam Practice Test