CCFR-201b Leak Questions

CrowdStrike Certified Falcon Responder Questions and Answers

Question 37

An analyst needs to quickly view the activity surrounding a suspicious process. Which of the following sequences of steps will pivot to an auto-filled process timeline in the Falcon UI?

Options:

Host Search > Processes and Services > Filename > Start Time > Process ID

Activity Dashboard > Click Detection > Export to PDF

Investigate > Bulk Search > Enter SHA256 > View Results

Configuration > Host Groups > Select Host > Network History

Question 38

The MITRE-Based Falcon Detections Framework is a core component of the Falcon UI. What is the primary operational advantage provided by this framework to a Tier 1 responder?

Options:

It allows for the automated decryption of files affected by ransomware.

It provides a standardized view of the attack lifecycle to help understand adversary behavior.

It enables the sensor to block kernel-level drivers from unknown publishers.

It provides a real-time count of the total number of files on the endpoint.

Question 39

A responder needs to find a specific sequence of network connections that did not trigger a detection. Which search tool allows them to search for anything within the raw telemetry?

Options:

Host Search

Event Search

Hash Search

User Search

Question 40

Multiple detections with the process schtasks.exe begin to alert in the UI. The process executes the following command line on several unique hosts:

schtasks.exe /Query /TN " Qljsscdqr "

What is the most efficient way to identify which hosts are executing this scheduled task?

Options:

Filter detections by command line and sort by ' Host:A to Z '

Filter detections by command line and group by triggering file

Filter detections by the triggering file and sort by ' Host:A to Z '

Filter detections by command line and group by host

Summer Certification Sale 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: save70

CrowdStrike Certified Falcon Responder Questions and Answers

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

Explanation:

CompTIA

Fortinet

Microsoft

Salesforce