CCFR CCFR-201b Updated Exam

CrowdStrike Certified Falcon Responder Questions and Answers

Question 49

The ' Detection Resolutions ' dashboard helps track team performance. Which of the following CANNOT be seen from this dashboard?

Options:

Average time to resolve a detection.

Total number of detections resolved by each analyst.

The top 10 hosts/users/files with the most detections.

The breakdown of True Positive vs. False Positive resolutions.

Question 50

A responder needs to find a specific sequence of network connections that did not trigger a detection. Which search tool allows them to search for anything within the raw telemetry?

Options:

Host Search

Event Search

Hash Search

User Search

Question 51

Evaluate the following process tree observed in a detection:

root > smss.exe > winlogon.exe > userinit.exe > explorer.exe > windows_media_player_y35s21-4ak.exe

Based on the parent-child relationships, which entry source is most likely?

Options:

A remote service exploitation targeting a system process.

A phishing attack where the user executed a malicious file from the desktop.

A scheduled task running under the SYSTEM account.

A supply chain attack targeting the Windows Boot manager.

Question 52

You receive an email from a third-party vendor that one of their services is compromised,thevendor names a specific IP address that the compromised service was using. Where would you input this indicator to find any activity related to this IP address?

Options:

IP Addresses

Remote or Network Logon Activity

Remote Access Graph

Hash Executions

Summer Certification Sale 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: save70

CrowdStrike Certified Falcon Responder Questions and Answers

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

CompTIA

Fortinet

Microsoft

Salesforce