Free CrowdStrike CCFR-201b Practice Exam with Questions & Answers | Set: 2

The correct item to select is Process ID. In Falcon investigations, a Process Timeline requires the sensor-specific process identifier, not merely the operating system PID. The OS PID can be reused over time and is not sufficiently unique for reliable historical telemetry correlation. The Falcon Process ID maps to the process record used by the platform to retrieve process-related events such as file writes, network connections, registry activity, DNS requests, and child process creation. Selecting the command line may provide useful context, but it does not pivot directly into the process timeline. Selecting PID is less precise because it refers to the local operating system process identifier. For accurate process-scoped investigation, the Process ID is the correct pivot point.

When pre-staging a Custom IOC for later use, the correct action is No Action because the responder wants to save the hash without immediately generating detections or enforcing a block. This is useful when an indicator is being prepared for approval, validation, or future activation. “Always Block” would actively prevent execution and should only be used when the hash is confirmed malicious and ready for enforcement. “Monitor” would generate visibility, but that is still an active detection posture rather than a passive staged state. “Save Hash” is not the correct Falcon IOC action. In Falcon Responder workflows, choosing the correct IOC action matters because a premature block or detection can disrupt operations or create unnecessary alert volume.

The correct field is FilePath because the investigation is focused on events executing from a specific directory on the host. In Falcon Event Search, path-based filtering is used when a responder wants to identify activity tied to a folder location such as a user profile, temp directory, startup folder, or suspicious staging path. TreeId is related to process lineage and is not the right field for directory matching. @source identifies the data source or index-related context, not the executable location. ParentBaseFileName is useful when searching for child processes launched by a specific parent executable, but it does not identify where the executing file resides. FilePath directly maps to the file location, making it the correct field for directory-based event hunting.