CCFR-201B Exam Questions

What are Event Actions?

Where are quarantined files stored on Windows hosts?

How long does detection data remain in the CrowdStrike Cloud before purging begins?

Which is TRUE regarding a file released from quarantine?

From the Detections page, how can you view 'in-progress' detections assigned to Falcon Analyst Alex?

The Bulk Domain Search tool contains Domain information along with which of the following?

The Process Activity View provides a rows-and-columns style view of the events generated in a detection. Why might this be helpful?

Which Executive Summary dashboard item indicates sensors running with unsupported versions?

What do IOA exclusions help you achieve?

When examining a raw DNS request event, you see a field called ContextProcessId_decimal. What is the purpose of that field?

The function of Machine Learning Exclusions is to _____________.

You found a list of SHA256 hashes in an intelligence report and search for them using the Hash Execution Search. What can be determined from the results?

In the Hash Search tool, which of the following is listed under Process Executions?

What is the difference between a Host Search and a Host Timeline?

What is the difference between Managed and Unmanaged Neighbors in the Falcon console?

What is an advantage of using the IP Search tool?

What happens when you open the full detection details?

After pivoting to an event search from a detection, you locate the ProcessRollup2 event. Which two field values are you required to obtain to perform a Process Timeline search so y...

Which of the following is NOT a valid event type?

When examining raw event data, what is the purpose of the field called ParentProcessId_decimal?

Which of the following is returned from the IP Search tool?

What types of events are returned by a Process Timeline?

After running an Event Search, you can select many Event Actions depending on your results. Which of the following is NOT an option for any Event Action?

From a detection, what is the fastest way to see children and sibling process information?

A list of managed and unmanaged neighbors for an endpoint can be found:

What happens when you create a Sensor Visibility Exclusion for a trusted file path?

Aside from a Process Timeline or Event Search, how do you export process event data from a detection in .CSV format?

The Falcon platform will show a maximum of how many detections per day for a single Agent Identifier (AID)?

When looking at the details of a detection, there are two fields called Global Prevalence and Local Prevalence. Which answer best defines Local Prevalence?

When analyzing an executable with a global prevalence of common; but you do not know what the executable is, what is the best course of action?

Which of the following is an example of a MITRE ATT&CK tactic?

What happens when a hash is set to Always Block through IOC Management?

Which of the following is NOT a filter available on the Detections page?

You can jump to a Process Timeline from many views, like a Hash Search, by clicking which of the following?

How long are quarantined files stored on the host?

Which statement is TRUE regarding the "Bulk Domains" search?

How are processes on the same plane ordered (bottom 'VMTOOLSD.EXE' to top 'CMD.EXE')?

What does pivoting to an Event Search from a detection do?

You notice that taskeng.exe is one of the processes involved in a detection. What activity should you investigate next?

Which of the following tactic and technique combinations is sourced from MITRE ATT&CK information?

What happens when a hash is allowlisted?

The primary purpose for running a Hash Search is to:

What does the Full Detection Details option provide?

Which option indicates a hash is allowlisted?

Where can you find hosts that are in Reduced Functionality Mode?

When reviewing a Host Timeline, which of the following filters is available?

How does a DNSRequest event link to its responsible process?

What information does the MITRE ATT&CK Framework provide?

Within the MITRE-Based Falcon Detections Framework, what is the correct way to interpret Keep Access > Persistence > Create Account?

When you configure and apply an IOA exclusion, what impact does it have on the host and what you see in the console?