CrowdStrike CCFR-201b Actual Free Exam Questions & Community Discussion
An analyst needs to quickly view the activity surrounding a suspicious process. Which of the following sequences of steps will pivot to an auto-filled process timeline in the Falcon UI?
Correct Answer: B
Vote an answer
What action is used when you want to save a prevention hash for later use?
Correct Answer: D
Vote an answer
You found a list of SHA256 hashes in an intelligence report and search for them using the Hash Execution Search. What can be determined from the results?
Correct Answer: B
Vote an answer
In the Hash Search tool, which of the following is listed under Process Executions?
Correct Answer: C
Vote an answer
When reviewing CrowdScore Incidents, which of the following statements is INCORRECT?
Correct Answer: A
Vote an answer
A responder is analyzing a MITRE-related alert and sees the technique ' Explore > Discovery > Cloud Service Dashboard ' . Which of the following scenarios best describes the technical activity associated with this technique?
Correct Answer: D
Vote an answer
CrowdStrike implements a specific framework within the Falcon console to help responders categorize detections based on the adversary's ultimate goals and the technical means used to achieve them. This classification system, which maps activity to known industry standards, is known as the:
Correct Answer: B
Vote an answer
In the " Full Detection Details " , which view will provide an exportable text listing of events like DNS requests. Registry Operations, and Network Operations?
Correct Answer: D
Vote an answer
When training a new team member on how to interpret Falcon telemetry, a senior responder explains the definition of a ' Tactic ' . Which of the following sentences best captures the technical definition of a Tactic in this context?
Correct Answer: B
Vote an answer
0
0
0
10