CCFR-201b Leak Questions

CrowdStrike Certified Falcon Responder Questions and Answers

Question 37

In the ' User Search - File Written ' section, a responder can see various files dropped by a user. Which of the following file types CANNOT be seen from this view?

Options:

Scripts (.ps1, .sh)

Executables (.exe)

Executions (Process starts)

Archive files (.zip, .7z)

Question 38

When examining a raw DNS request event, you see a field called ContextProcessld_decimal. What is the purpose of that field?

Options:

It contains the TargetProcessld_decimal value for other related events

It contains an internal value not useful for an investigation

It contains the ContextProcessld_decimal value for the parent process that made the DNS request

It contains the TargetProcessld_decimal value for the process that made the DNS request

Question 39

You found a list of SHA256 hashes in an intelligence report and search for them using the Hash Execution Search. What can be determined from the results?

Options:

Identifies a detailed list of all process executions for the specified hashes

Identifies hosts that loaded or executed the specified hashes

Identifies users associated with the specified hashes

Identifies detections related to the specified hashes

Question 40

Depending on the subscription level, " Cloudable Events " (standard telemetry) have a specific retention period. What is the minimum period of time that these events are retained?

Options:

1 day

7 days

14 days

30 days

Summer Certification Sale 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: save70

CrowdStrike Certified Falcon Responder Questions and Answers

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

CompTIA

Fortinet

Microsoft

Salesforce