CrowdStrike Certified Falcon Responder - CCFR-201 Exam Practice Test

Question 1

When looking at the details of a detection, there are two fields called Global Prevalence and Local Prevalence.
Which answer best defines Local Prevalence?

A. Local prevalence is the frequency with which the hash of the triggering file is seen across the entire Internet

B. Local prevalence is the frequency with which the hash of the triggering file is seen across all CrowdStrike customer environments

C. Local Prevalence tells you how common the hash of the triggering file is within your environment (CID)

D. Local Prevalence is the Virus Total score for the hash of the triggering file

Correct Answer: C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 2

You are notified by a third-party that a program may have redirected traffic to a malicious domain. Which Falcon page will assist you in searching for any domain request information related to this notice?

A. Investigate

B. Discover

C. Spotlight

D. Falcon X

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 3

What happens when a hash is set to Always Block through IOC Management?

A. Execution is prevented and detection alerts are suppressed

B. The hash is submitted for approval to be blocked from execution once confirmed by Falcon specialists

C. Execution is prevented on all hosts by default

D. Execution is prevented on selected host groups

Correct Answer: C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 4

In the Hash Search tool, which of the following is listed under Process Executions?

A. Sensor Version

B. Operating System

C. File Signature

D. Command Line

Correct Answer: D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 5

When examining raw event data, what is the purpose of the field called ParentProcessld_decimal?

A. It contains the TargetProcessld_decimal value of the child process

B. It contains the Sensorld_decimal value for related events

C. It contains an internal value not useful for an investigation

D. It contains the TargetProcessld_decimal of the parent process

Correct Answer: D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 6

What action is used when you want to save a prevention hash for later use?

A. No Action

B. Always Allow

C. Always Block

D. Never Block

Correct Answer: C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 7

In the "Full Detection Details", which view will provide an exportable text listing of events like DNS requests.
Registry Operations, and Network Operations?

A. View as Process Timeline

B. View as Process Tree

C. Thedata is unable to be exported

D. View as Process Activity

Correct Answer: D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

CrowdStrike Certified Falcon Responder - CCFR-201 Exam Practice Test

Latest Update

Useful Links

Contact Us