Free CrowdStrike CCFR-201b Practice Exam with Questions & Answers | Set: 6

Name: How to Pass CCFR-201b Exams
Brand: Examstrack
SKU: ccfr-201b
Price: 31.5 USD
Availability: InStock

Questions 51

When an analyst downloads a quarantined file from the Falcon UI for offline analysis, what is the specific file format and the required password for extraction?

Options:

The file is downloaded as a 7-zip archive and requires the password ' infected ' for extraction.

The file is downloaded in its raw binary format without any encryption or compression.

The file is downloaded as a standard ZIP archive but does not require a password to open.

The file is downloaded as an encrypted .exe that can only be opened by a CrowdStrike sensor.

CrowdStrike CCFR-201b Premium Access

Questions 52

During the triage of a detection involving a newly created persistent task, which specific indicator is most important for a responder to identify the actual intent of the service?

Options:

The total CPU usage of the parent process.

The command-line arguments used during the task creation.

The Agent ID (AID) of the host where the detection fired.

The physical location of the endpoint in the office.

Questions 53

When an analyst is trying to pinpoint the exact moment an endpoint came online after being shut down for the weekend, which timeline view is the best to use?

Options:

Process Timeline

Host Timeline

User Timeline

Network Timeline

Questions 54

A responder needs to categorize an incident based on the high-level goals of the attacker. Which of the following lists correctly identifies the " Objectives " as they are natively defined and used within the Falcon platform?

Options:

Explore, Keep Access, Gain Access, Falcon Detection Method, Contact Controlled systems, Follow Through

Reconnaissance, Delivery, Weaponization, Exploitation, Installation, Command and Control

Identify, Protect, Detect, Respond, Recover, Lessons Learned

Triage, Containment, Remediation, Eradication, Reporting, Recovery

Questions 55

To maintain a logical flow during an incident post-mortem, CrowdStrike recommends describing adversary activity using a specific three-part sentence structure. Which combination best completes this sentence: " The adversary was trying to [1], by [2] , using [3] " ?

Options:

< Technique > , < Tactic > , < Objective >

< Objective > , < Tactic > , < Technique >

< Objective > , < Technique > , < Tactic >

< Tactic > , < Objective > , < Technique >

Questions 56

What action is needed to ensure Falcon does not block or generate a detection for a process by using the file hash?

Options:

Create a Custom IOC with an action of allow for the hash

Create a Machine Learning Exclusion with an action of allow for the hash

Create a Custom IOA with an action of allow for the hash

Create an IOA Exclusion with an action of allow for the hash

Questions 57

Falcon uses specific identifiers to track processes across the environment. Which of the following sentences best describes what the ' TargetProcessId_decimal ' raw data represents?

Options:

The standard Process ID (PID) assigned by the Windows operating system.

A sensor-assigned decimal number that is unique for each process across time and hosts.

The memory address where the process’s executable is loaded.

The total number of seconds the process has been running.

Questions 58

After pivoting to an event search from a detection, you locate the ProcessRollup2 event. Which two field values are you required to obtain to perform a Process Timeline search so you can determine what the process was doing?

Options:

SHA256 and TargetProcessld_decimal

SHA256 and ParentProcessld_decimal

aid and ParentProcessld_decimal

aid and TargetProcessld_decimal

Questions 59

Refer to the image.

CCFR-201b Question 59