Summer Sale Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: 70track

Free CrowdStrike CCFR-201b Practice Exam with Questions & Answers

Questions 1

After running an Event Search, you can select many Event Actions depending on your results. Which of the following is NOT an option for any Event Action?

Options:
A.

Draw Process Explorer

B.

Show a +/- 10-minute window of events

C.

Show a Process Timeline for the responsible process

D.

Show Associated Event Data (from TargetProcessld_decimal or ContextProcessld_decimal)

CrowdStrike CCFR-201b Premium Access
Questions 2

An analyst wants to see the raw events behind a specific detection. Which icon in the UI allows them to pivot directly to an event search?

Options:
A.

Shield icon

B.

Spyglass icon

C.

Trash can icon

D.

Gear icon

Questions 3

When an analyst downloads a quarantined file from the Falcon UI for offline analysis, what is the specific file format and the required password for extraction?

Options:
A.

The file is downloaded as a 7-zip archive and requires the password ' infected ' for extraction.

B.

The file is downloaded in its raw binary format without any encryption or compression.

C.

The file is downloaded as a standard ZIP archive but does not require a password to open.

D.

The file is downloaded as an encrypted .exe that can only be opened by a CrowdStrike sensor.

Questions 4

In the context of raw event searching, the term ' ProcessRollup2 ' refers to a value within which field?

Options:
A.

event_type

B.

event_simpleName

C.

action_id

D.

process_status

Questions 5

When training a new team member on how to interpret Falcon telemetry, a senior responder explains the definition of a ' Tactic ' . Which of the following sentences best captures the technical definition of a Tactic in this context?

Options:
A.

It represents the specific software version or exploit code used to crash a service.

B.

It is the adversary ' s tactical goal: the fundamental reason for performing a specific action.

C.

It is the unique cryptographic hash associated with a malicious file discovered on disk.

D.

It is the specific command-line string used to execute a PowerShell script.

Questions 6

You are pre-staging a Custom IOC for later use and want to save a file hash for later use after approval.

Which action should you use?

Options:
A.

Save Hash

B.

Monitor

C.

No Action

D.

Always Block

Questions 7

Responders often use Process Explorer to visualize process behavior. Which of the following is NOT a valid way to pivot to a Process Explorer view?

Options:
A.

From Detection > Top Right Drop Down > View as Process Activity

B.

From Configuration > Prevention Policies > View Process Explorer

C.

From Event Search > Click on a specific Process ID

D.

From Host Search > Processes and Services list

Questions 8

What action is used when you want to save a prevention hash for later use?

Options:
A.

Always Block

B.

Never Block

C.

Always Allow

D.

No Action

Questions 9

What information is contained within a Process Timeline?

Options:
A.

All cloudable process-related events within a given timeframe

B.

All cloudable events for a specific host

C.

Only detection process-related events within a given timeframe

D.

A view of activities on Mac or Linux hosts

Questions 10

How long are quarantined files stored in the CrowdStrike Cloud?

Options:
A.

45 Days

B.

90 Days

C.

Days

D.

Quarantined files are not deleted

Exam Code: CCFR-201b
Certification Provider: CrowdStrike
Exam Name: CrowdStrike Certified Falcon Responder
Last Update: Aug 8, 2026
Questions: 209

CrowdStrike Related Exams

CCSA-205 - CrowdStrike Certified SIEM Analyst
CCCS-203b - CrowdStrike Certified Cloud Specialist
IDP - CrowdStrike Certified Identity Specialist(CCIS) Exam
CCSE-204 - CrowdStrike Engineer
CCFA-200b - CrowdStrike Falcon Certification Program
CCFH-202b - CrowdStrike Certified Falcon Hunter
CrowdStrike Free Access
Get CrowdStrike Full Access

CrowdStrike Free Exams
CrowdStrike Free Exams
Examstrack provides free CrowdStrike exam prep materials and practice tests to support your CrowdStrike certification goals.