Free CCFR-201b Questions Attempt

CrowdStrike Certified Falcon Responder Questions and Answers

Question 17

An analyst is triaging a detection that has been categorized under the ‘Follow Through’ Objective Layer. Based on the Falcon technical documentation, which of the following adversary tactics is most likely to be observed within this specific layer?

Options:

Credential Access through memory scraping

Collection of sensitive data for exfiltration

Initial Access via a drive-by download

Discovery of local network shares and services

Question 18

In the ' Graph View ' of a detection, processes are connected by arrows. Which of the following does a yellow arrow connecting two processes indicate?

Options:

A standard Parent-Child relationship.

A Network connection was established between the two processes.

A Thread Injector-Injectee relationship (Process Injection).

A file was written by the first process and read by the second.

Question 19

The primary purpose for running a Hash Search is to:

Options:

determine any network connections

review the processes involved with a detection

determine the origin of the detection

review information surrounding a hash ' s related activity

Question 20

To speed up investigations, Falcon uses ' event workflows ' . Which of the following sentences best describes what event workflows are?

Options:

They are automated scripts that perform remediation actions like killing processes.

They are automated searches that can be used to pivot between related events and searches.

They are PDF reports that summarize an incident for executive review.

They are schedules for when the sensor should perform a full disk scan.

Summer Certification Sale 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: save70

CrowdStrike Certified Falcon Responder Questions and Answers

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

CompTIA

Fortinet

Microsoft

Salesforce