All CCFR-201b Test Inside CrowdStrike Questions

CrowdStrike Certified Falcon Responder Questions and Answers

Question 25

Which specific event type in the Falcon telemetry is associated with the creation of a new ' TargetProcessId_decimal ' ?

Options:

ProcessRollup2

FileCreation

NetworkConnect

RegistryUpdate

Question 26

Which statement is TRUE regarding the " Bulk Domains " search?

Options:

It will show a list of computers and process that performed a lookup of any of the domains in your search

The " Bulk Domains " search will allow you to blocklist your queried domains

The " Bulk Domains " search will show IP address and port information for any associated connections D. You should only pivot to the " Bulk Domains " search tool after completing an investigation

Question 27

When viewing the summary list on the ' Endpoint Detections ' page, an analyst sees a column for the timestamp. What does the timestamp in this specific summary view represent?

Options:

The exact time the Falcon sensor was first installed on the host.

The timestamp of the last activity recorded for that specific detection.

The time the detection was first assigned to a human analyst.

The file creation time for the primary process involved in the alert.

Question 28

While reviewing the ' Detection Method ' field for a high-severity alert, a responder sees the label ' Post-Exploit ' . This terminology is used by CrowdStrike to identify a specific:

Options:

Falcon Detection Method

MITRE Tactic

Indicator of Attack (IOA)

Prevention Policy Level

Summer Certification Sale 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: save70

All CCFR-201b Test Inside CrowdStrike Questions

CrowdStrike Certified Falcon Responder Questions and Answers

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

CompTIA

Fortinet

Microsoft

Salesforce