Free CrowdStrike CCFR-201b Practice Exam with Questions & Answers | Set: 6

Name: How to Pass CCFR-201b Exams
Brand: Examstrack
SKU: ccfr-201b
Price: 31.5 USD
Availability: InStock

Questions 51

Where can you find hosts that are in Reduced Functionality Mode?

Options:

Event Search

Executive Summary dashboard

Host Search

Installation Tokens

CrowdStrike CCFR-201b Premium Access

Questions 52

The Falcon platform will show a maximum of how many detections per day for a single Agent Identifier (AID)?

Options:

500

750

1000

1200

Questions 53

When an organization needs to detect a specific behavior that is unique to their environment, they can create a Custom IOA. Which of the following is NOT required when configuring a custom IOA from scratch?

Options:

Selecting a Rule Type (e.g., Process Creation).

Specifying the Severity level of the resulting detection.

Assigning a specific host group to the IOA rule at the time of creation.

Providing a unique name for the rule.

Questions 54

In the ' Investigate > Hunt > Linux Sensors ' dashboard, responders can view various Linux-specific activities. Which of the following sub-titling is NOT displayed in this dashboard?

Options:

Sudo Executions

Cron Usage

Kernel Module Loads

User Logins

Questions 55

Refer to the image.

CCFR-201b Question 55

Within a Host Search, you have filtered for cmd.exe in the Process executions table and now need to pivot to a process timeline.

Which item in the table do you select to pivot to the Process Timeline?

Options:

PID

Process ID

Command Line

Questions 56

Filtering is essential for managing a high volume of alerts. Which of the following filters is available by default within the ' Endpoint Detections ' dashboard to help narrow down specific threats?

Options:

Triggering File

Hardware BIOS Version

Local Subnet Mask

Sensor Update Policy Name

Questions 57

Refer to Image:

CCFR-201b Question 57

You are investigating a network connection in event search.

Which option next to the raw event data should you select to pivot to a graphical representation for all the processes related to the network connection event?

Options:

Inspect

Show Responsible Process Data

Draw Process Explorer

Show Associated Event Data

Questions 58

An analyst notices a detection that has been automatically flagged with the ' New Activity ' status. Which of the following statements best describes what this status indicates?

Options:

A brand new detection has been triggered on a host that was recently added to the network.

A detection that was previously moved to a resolved status has generated new telemetry and activity.

A user has logged into a machine for the first time since the sensor was installed.

The Falcon Overwatch team has manually verified that the detection is an active threat.

Questions 59

To perform a deep-dive investigation into a specific detection, a responder needs to pivot to a process timeline. What is the minimum information required to be gathered from the detection before making this pivot?

Options:

The External IP and the Username of the logged-in user.

The Agent ID (AID) and the Target Process ID (TargetProcessId_decimal).

The MAC Address of the host and the SHA256 hash of the file.

The Policy ID and the timestamp of the first event.

Questions 60

The Falcon console integrates heavily with the MITRE ATT AND CK framework to provide industry-standard context. Which of the following tactics displayed in the detection UI is a direct implementation of a MITRE ATT AND CK tactic?

Options:

Malware Action

Impact

Intelligence-Based Match

Script-Based Execution