Free CrowdStrike CCFR-201b Practice Exam with Questions & Answers | Set: 5

Name: How to Pass CCFR-201b Exams
Brand: Examstrack
SKU: ccfr-201b
Price: 31.5 USD
Availability: InStock

Questions 41

The Falcon console is divided into several modules. Timelines (Host and Process) are technically a part of which Falcon page?

Options:

Activity

Investigate

Configuration

Dashboards

CrowdStrike CCFR-201b Premium Access

Questions 42

When an organization needs to detect a specific behavior that is unique to their environment, they can create a Custom IOA. Which of the following is NOT required when configuring a custom IOA from scratch?

Options:

Selecting a Rule Type (e.g., Process Creation).

Specifying the Severity level of the resulting detection.

Assigning a specific host group to the IOA rule at the time of creation.

Providing a unique name for the rule.

Questions 43

To understand how a threat moved on a system, a responder must know the role of common processes. Which of the following statements best describes the standard functionality of explorer.exe?

Options:

It is a system process responsible for the Local Security Authority subsystem.

It is the primary process responsible for the File Explorer UI and the user ' s desktop environment.

It is the Windows Command Processor used for executing batch files.

It is the service control manager that handles the starting of background tasks.

Questions 44

Executive dashboards provide a high-level view of security. Which of the following CANNOT be seen from the Executive Summary Dashboard?

Options:

Detections broken down by Tactic.

A breakdown of Agent Versions across the fleet.

The top 10 hosts with the most detections.

The organization’s current CrowdScore trend.

Questions 45

When analyzing an executable with a global prevalence of common; but you do not know what the executable is. what is the best course of action?

Options:

Do nothing, as this file is common and well known

From detection, click the VT Hash button to pivot to VirusTotal to investigate further

From detection, use API manager to create a custom blocklist

From detection, submit to FalconX for deep dive analysis

Questions 46

An analyst needs to quickly view the activity surrounding a suspicious process. Which of the following sequences of steps will pivot to an auto-filled process timeline in the Falcon UI?

Options:

Host Search > Processes and Services > Filename > Start Time > Process ID

Activity Dashboard > Click Detection > Export to PDF

Investigate > Bulk Search > Enter SHA256 > View Results

Configuration > Host Groups > Select Host > Network History

Questions 47

While the host timeline is comprehensive, some data is not included in that specific view. Which of the following CANNOT be seen directly from the host timeline?

Options:

Timestamp

Event Name

PID (Process ID)

CPU Temperature

Questions 48

Which of the following tactic and technique combinations is sourced from MITRE ATT AND CK information?

Options:

Falcon Intel via Intelligence Indicator - Domain

Machine Learning via Cloud-Based ML

Malware via PUP

Credential Access via OS Credential Dumping

Questions 49

You receive an email from a third-party vendor that one of their services is compromised,thevendor names a specific IP address that the compromised service was using. Where would you input this indicator to find any activity related to this IP address?

Options:

IP Addresses

Remote or Network Logon Activity

Remote Access Graph

Hash Executions

Questions 50

The Falcon console integrates heavily with the MITRE ATT AND CK framework to provide industry-standard context. Which of the following tactics displayed in the detection UI is a direct implementation of a MITRE ATT AND CK tactic?

Options:

Malware Action

Impact

Intelligence-Based Match

Script-Based Execution