Free CrowdStrike CCFR-201b Practice Exam with Questions & Answers | Set: 3

Name: How to Pass CCFR-201b Exams
Brand: Examstrack
SKU: ccfr-201b
Price: 31.5 USD
Availability: InStock

Questions 21

What types of events are returned by a Process Timeline?

Options:

Only detection events

All cloudable events

Only process events

Only network events

CrowdStrike CCFR-201b Premium Access

Questions 22

To ensure that a malicious file cannot be accidentally executed or accessed by other processes, how are quarantined files stored on the local endpoints?

Options:

They are hidden within the Windows System32 directory.

They are stored in an encrypted format.

They are renamed with a random 32-character extension.

They are moved to a password-protected ZIP file on the desktop.

Questions 23

What are Event Actions?

Options:

Automated searches that can be used to pivot between related events and searches

Pivotable hyperlinks available in a Host Search

Custom event data queries bookmarked by the currently signed in Falcon user

Raw Falcon event data

Questions 24

What action is used when you want to save a prevention hash for later use?

Options:

Always Block

Never Block

Always Allow

No Action

Questions 25

Filtering is essential for managing a high volume of alerts. Which of the following filters is available by default within the ' Endpoint Detections ' dashboard to help narrow down specific threats?

Options:

Triggering File

Hardware BIOS Version

Local Subnet Mask

Sensor Update Policy Name

Questions 26

A responder wants to include a visual representation of a process tree in an incident report. Which of the following is NOT a valid way to export process data from ' Full Detection Details ' ?

Options:

Process Tree > PNG

Process Tree > JPEG

Detection > CSV

Process Tree > JSON

Questions 27

To track the relationship between a parent and its child, Falcon uses specific ID fields. What raw data is used as the ' ParentProcessId_decimal ' when a process spawns a child process?

Options:

The Operating System PID of the parent.

The TargetProcessId_decimal of the parent process.

The ContextProcessId_decimal of the system.

The RootProcessId_decimal of the entire tree.

Questions 28

To speed up investigations, Falcon uses ' event workflows ' . Which of the following sentences best describes what event workflows are?

Options:

They are automated scripts that perform remediation actions like killing processes.

They are automated searches that can be used to pivot between related events and searches.

They are PDF reports that summarize an incident for executive review.

They are schedules for when the sensor should perform a full disk scan.

Questions 29

After running an Event Search, you can select many Event Actions depending on your results. Which of the following is NOT an option for any Event Action?

Options:

Draw Process Explorer

Show a +/- 10-minute window of events

Show a Process Timeline for the responsible process

Show Associated Event Data (from TargetProcessld_decimal or ContextProcessld_decimal)

Questions 30

Data retention is a key factor in retrospective hunting. How long will " Detection Related Events " be retained in the Falcon environment?

Options:

30 days

60 days

90 days

1 year