Free CrowdStrike CCFR-201b Practice Exam with Questions & Answers | Set: 4

Name: How to Pass CCFR-201b Exams
Brand: Examstrack
SKU: ccfr-201b
Price: 31.5 USD
Availability: InStock

Questions 31

A responder is explaining the quarantine process to a system administrator. What happens technically when a file is quarantined by the Falcon sensor?

Options:

It is deleted from the disk and a log is sent to the cloud.

It is moved to the CrowdStrike Cloud and removed from the local host immediately.

It is compressed, password protected, and moved to the Quarantine folder on the endpoint.

It is renamed to a .tmp extension and moved to the Windows Recycle Bin.

CrowdStrike CCFR-201b Premium Access

Questions 32

Which Executive Summary dashboard item indicates sensors running with unsupported versions?

Options:

Detections by Severity

Inactive Sensors

Sensors in RFM

Active Sensors

Questions 33

CrowdScore is a metric used to identify the severity of an ongoing incident. What percentage of increase in a CrowdScore is considered a strong indication of a coordinated attack?

Options:

10%

20%

50%

100%

Questions 34

Responders use ' IP Search ' to track connections to malicious infrastructure. Which of the following statements about the IP Search is FALSE?

Options:

It identifies every host that connected to a specific IP.

It provides Intel data if the IP is known to CrowdStrike.

The search only allows for one IP to be entered at a time.

It shows the first and last time the IP was seen in the environment.

Questions 35

While reviewing the high-level organizational structure of a complex detection in the Falcon console, a responder identifies several layers of activity. Which of the following is NOT officially recognized as an Objective Layer within the CrowdStrike detection hierarchy?

Options:

Contact Controlled Systems

Lateral Movement

Gain Access

Follow Through

Questions 36

CrowdStrike provides ' Overwatch Best Practices ' for triaging alerts. According to these guidelines, what is the next step a responder should take immediately after the ' Understand the detection ' step?

Options:

Isolate the host from the network.

Review the process tree to understand the origin of the activity.

Perform an OSINT search for the suspicious hash.

Resolve the detection as a True Positive.

Questions 37

You found a list of SHA256 hashes in an intelligence report and search for them using the Hash Execution Search. What can be determined from the results?

Options:

Identifies a detailed list of all process executions for the specified hashes

Identifies hosts that loaded or executed the specified hashes

Identifies users associated with the specified hashes

Identifies detections related to the specified hashes

Questions 38

In various telemetry events like ' FileWrite ' or ' NetworkConnect ' , Falcon identifies the process that performed the action. Which field will always identify this " acting " process?

Options:

ContextProcessId_decimal

TargetProcessId_decimal

ParentProcessId_decimal

OwnerProcessId_decimal

Questions 39

A list of managed and unmanaged neighbors for an endpoint can be found:

Options:

by using Hosts page in the Investigate tool

by reviewing " Groups " in Host Management under the Hosts page

under " Audit " by running Sensor Visibility Exclusions Audit

only by searching event data using Event Search

Questions 40

A security responder is investigating a detection where a low-privileged process attempted to manipulate a system token to gain administrative rights. Within the specific terminology used by the Falcon console, ' Privilege Escalation ' is classified as a:

Options:

Technique

Tactic

Objective

Indicator