CCFR-201b Exam Questions Tutorials

CrowdStrike Certified Falcon Responder Questions and Answers

Question 21

When reviewing a Host Timeline, which of the following filters is available?

Options:

Severity

Event Types

User Name

Detection ID

Question 22

How are processes on the same plane ordered (bottom ' VMTOOLSD.EXE ' to top CMD.EXE ' )?

Options:

Process ID (Descending, highest on bottom)

Time started (Descending, most recent on bottom)

Time started (Ascending, most recent on top)

Process ID (Ascending, highest on top)

Question 23

To maintain a logical flow during an incident post-mortem, CrowdStrike recommends describing adversary activity using a specific three-part sentence structure. Which combination best completes this sentence: " The adversary was trying to [1], by [2] , using [3] " ?

Options:

< Technique > , < Tactic > , < Objective >

< Objective > , < Tactic > , < Technique >

< Objective > , < Technique > , < Tactic >

< Tactic > , < Objective > , < Technique >

Question 24

Which of the following subtitles/sub-views cannot be seen in the results of a ' Hash Search ' ?

Options:

File Metadata

Process Timeline

Intel Indicators

Execution History

Summer Certification Sale 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: save70

CrowdStrike Certified Falcon Responder Questions and Answers

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

CompTIA

Fortinet

Microsoft

Salesforce