Selected CCFR-201b CCFR Questions Answers

CrowdStrike Certified Falcon Responder Questions and Answers

Question 45

Which specific event type in the Falcon telemetry is associated with the creation of a new ' TargetProcessId_decimal ' ?

Options:

ProcessRollup2

FileCreation

NetworkConnect

RegistryUpdate

Question 46

A responder is focused on a specific malicious script and wants to see everything that the script ' s process did. Which timeline is the best tool for this task?

Options:

Host Timeline

Process Timeline

User Timeline

Administrative Timeline

Question 47

What happens when a hash is set to Always Block through IOC Management?

Options:

Execution is prevented on all hosts by default

Execution is prevented on selected host groups

Execution is prevented and detection alerts are suppressed

The hash is submitted for approval to be blocked from execution once confirmed by Falcon specialists

Question 48

You can jump to a Process Timeline from many views, like a Hash Search, by clicking which of the following?

Options:

ProcessTimeline Link

PID

UTCtime

Process ID or Parent Process ID

Summer Certification Sale 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: save70

Selected CCFR-201b CCFR Questions Answers

CrowdStrike Certified Falcon Responder Questions and Answers

Options:

Answer:

Options:

Answer:

Options:

Answer:

Options:

Answer:

CompTIA

Fortinet

Microsoft

Salesforce