Free CrowdStrike CCFR-201b Practice Exam with Questions & Answers | Set: 2

Name: How to Pass CCFR-201b Exams
Brand: Examstrack
SKU: ccfr-201b
Price: 31.5 USD
Availability: InStock

Questions 11

The Falcon console is divided into several modules. Timelines (Host and Process) are technically a part of which Falcon page?

Options:

Activity

Investigate

Configuration

Dashboards

CrowdStrike CCFR-201b Premium Access

Questions 12

Responders must understand the limitations and capabilities of custom rules. Which of the following statements about custom IOAs is FALSE?

Options:

They can be used to monitor or block specific command-line strings.

A Custom IOA rule group can only be applied to one single prevention policy.

They can generate ' Informational ' detections if set to the ' Monitor ' action.

They allow for pattern matching using wildcards or specific strings.

Questions 13

When navigating the main ' Detections ' page, several filters are available in the dropdown menu. Which of the following is NOT a filter available in this menu?

Options:

Severity

Tactic

Location tag

Status

Questions 14

The MITRE-Based Falcon Detections Framework is a core component of the Falcon UI. What is the primary operational advantage provided by this framework to a Tier 1 responder?

Options:

It allows for the automated decryption of files affected by ransomware.

It provides a standardized view of the attack lifecycle to help understand adversary behavior.

It enables the sensor to block kernel-level drivers from unknown publishers.

It provides a real-time count of the total number of files on the endpoint.

Questions 15

When viewing the main ' Quarantine ' dashboard to manage blocked files, which of the following pieces of information CANNOT be seen by default?

Options:

Filename

Host Name

Hash

Date Quarantined

Questions 16

The ' Detection Resolutions ' dashboard helps track team performance. Which of the following CANNOT be seen from this dashboard?

Options:

Average time to resolve a detection.

Total number of detections resolved by each analyst.

The top 10 hosts/users/files with the most detections.

The breakdown of True Positive vs. False Positive resolutions.

Questions 17

Which tool or search type is recommended as the " best search " to use when performing the " Examine what ' s normal for this system " step in an investigation?

Options:

User Search

Host Search

Hash Search

IP Search

Questions 18

What does the Full Detection Details option provide?

Options:

It provides a visualization of program ancestry via the Process Tree View

It provides a visualization of program ancestry via the Process Activity View

It provides detailed list of detection events via the Process Table View

It provides a detailed list of detection events via the Process Tree View

Questions 19

An analyst is triaging a detection that has been categorized under the ‘Follow Through’ Objective Layer. Based on the Falcon technical documentation, which of the following adversary tactics is most likely to be observed within this specific layer?

Options:

Credential Access through memory scraping

Collection of sensitive data for exfiltration

Initial Access via a drive-by download

Discovery of local network shares and services

Questions 20

What happens when you open the full detection details?

Options:

Theprocess explorer opens and the detection is removed from the console

The process explorer opens and you ' re able to view the processes and process relationships

The process explorer opens and the detection copies to the clipboard

The process explorer opens and the Event Search query is run for the detection