CCFR CCFR-201b Updated Exam

CrowdStrike Certified Falcon Responder Questions and Answers

Question 49

In the Falcon Overwatch Best Practice workflow, at what specific point is a responder encouraged to utilize OSINT (Open Source Intelligence) searches?

Options:

During the ' Understand the detection ' phase.

During the ' Understand process(es) involved ' phase.

During the ' Examine what is normal for the system ' phase.

After the incident has been fully remediated.

Question 50

To maintain a logical flow during an incident post-mortem, CrowdStrike recommends describing adversary activity using a specific three-part sentence structure. Which combination best completes this sentence: " The adversary was trying to [1], by [2] , using [3] " ?

Options:

< Technique > , < Tactic > , < Objective >

< Objective > , < Tactic > , < Technique >

< Objective > , < Technique > , < Tactic >

< Tactic > , < Objective > , < Technique >

Question 51

You are notified by a third-party that a program may have redirected traffic to a malicious domain. Which Falcon page will assist you in searching for any domain request information related to this notice?

Options:

Falcon X

Investigate

Discover

Spotlight

Question 52

Bulk Search tools have several features in common. Which of the following is incorrect as a feature common to all Bulk Search types?

Options:

They allow for searching multiple items (up to 500) at once.

Regular Expressions (Regex) are allowed within the search fields.

Search results can be exported for further analysis.

They search across historical telemetry in the cloud.

Summer Certification Sale 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: save70

CrowdStrike Certified Falcon Responder Questions and Answers

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

CompTIA

Fortinet

Microsoft

Salesforce