Updated Mar-2024 Exam Engine for CCFR-201 Exam Free Demo & 365 Day Updates
Exam Passing Guarantee CCFR-201 Exam with Accurate Quastions!
NEW QUESTION # 35
What is the difference between Managed and Unmanaged Neighbors in the Falcon console?
- A. A managed neighbor has an installed and provisioned sensor
- B. An unmanaged neighbor is in a segmented area of the network
- C. A managed sensor has an active prevention policy
- D. A managed neighbor is currently network contained and an unmanaged neighbor is uncontained
Answer: A
Explanation:
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, you can use the Hosts page in the Investigate tool to view information about your endpoints, such as hostname, IP address, OS, sensor version, etc2. You can also see a list of managed and unmanaged neighbors for each endpoint, which are other devices that have communicated with that endpoint over the network2. A managed neighbor is a device that has an installed and provisioned sensor that reports to the CrowdStrike Cloud2. An unmanaged neighbor is a device that does not have an installed or provisioned sensor2.
NEW QUESTION # 36
After pivoting to an event search from a detection, you locate the ProcessRollup2 event. Which two field values are you required to obtain to perform a Process Timeline search so you can determine what the process was doing?
- A. SHA256 and ParentProcessld_decimal
- B. aid and TargetProcessld_decimal
- C. SHA256 and TargetProcessld_decimal
- D. aid and ParentProcessld_decimal
Answer: B
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Process Timeline search requires two parameters: aid (agent ID) and TargetProcessId_decimal (the decimal value of the process ID). These fields can be obtained from the ProcessRollup2 event, which contains information about processes that have executed on a host1.
NEW QUESTION # 37
You notice that taskeng.exe is one of the processes involved in a detection. What activity should you investigate next?
- A. Scheduled tasks registered prior to the detection
- B. User logons after the detection
- C. Executions of schtasks.exe after the detection
- D. Pivot to a Hash search for taskeng.exe
Answer: A
Explanation:
Explanation
According to the [Microsoft website], taskeng.exe is a legitimate Windows process that is responsible for running scheduled tasks. However, some malware may use this process or create a fake one to execute malicious code. Therefore, if you notice taskeng.exe involved in a detection, you should investigate whether there are any scheduled tasks registered prior to the detection that may have triggered or injected into taskeng.exe. You can use tools such as schtasks.exe or Task Scheduler to view or manage scheduled tasks.
NEW QUESTION # 38
How does a DNSRequest event link to its responsible process?
- A. Via its ParentProcessld_decimal field
- B. Via its TargetProcessld_decimal field
- C. Via both its ContextProcessld__decimal and ParentProcessld_decimal fields
- D. Via its ContextProcessld_decimal field
Answer: D
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, a DNSRequest event contains information about a DNS query made by a process2. The event has several fields, such as DomainName, QueryType, QueryResponseCode, etc2. The field that links a DNSRequest event to its responsible process is ContextProcessId_decimal, which contains the decimal value of the process ID of the process that generated the event2. You can use this field to trace the process lineage and identify malicious or suspicious activities2.
NEW QUESTION # 39
What happens when a hash is allowlisted?
- A. Execution is prevented, but detection alerts are suppressed
- B. Execution is allowed on all hosts that fall under the organization's CID
- C. Execution is allowed on all hosts, including all other Falcon customers
- D. The hash is submitted for approval to be allowed to execute once confirmed by Falcon specialists
Answer: B
Explanation:
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, the allowlist feature allows you to exclude files or directories from being scanned or blocked by CrowdStrike's machine learning engine or indicators of attack (IOAs)2. This can reduce false positives and improve performance2. When you allowlist a hash, you are allowing that file to execute on any host that belongs to your organization's CID (customer ID)2. This does not affect other Falcon customers or hosts outside your CID2.
NEW QUESTION # 40
You receive an email from a third-party vendor that one of their services is compromised,thevendor names a specific IP address that the compromised service was using. Where would you input this indicator to find any activity related to this IP address?
- A. Remote or Network Logon Activity
- B. IP Addresses
- C. Remote Access Graph
- D. Hash Executions
Answer: B
Explanation:
Explanation
According to the [CrowdStrike website], the Discover page is where you can search for and analyze various types of indicators of compromise (IOCs), such as hashes, IP addresses, or domains that are associated with malicious activities. You can use various tools, such as Hash Executions, IP Addresses, Remote or Network Logon Activity, etc., to perform different types of searches and view the results in different ways. If you want to search for any activity related to an IP address that was compromised by a third-party vendor, you can use the IP Addresses tool to do so. You can input the IP address and see a summary of information from Falcon events that contain that IP address, such as hostname, sensor ID, OS, country, city, ISP, ASN, geolocation, process name, command line, and organizational unit of the host that communicated with that IP address.
NEW QUESTION # 41
What does the Full Detection Details option provide?
- A. It provides a visualization of program ancestry via the Process Tree View
- B. It provides a visualization of program ancestry via the Process Activity View
- C. It provides detailed list of detection events via the Process Table View
- D. It provides a detailed list of detection events via the Process Tree View
Answer: A
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Full Detection Details option allows you to view detailed information about a detection, such as detection ID, severity, tactic, technique, description, etc1. You can also view the events generated by the processes involved in the detection in different ways, such as process tree, process timeline, or process activity1. The process tree view provides a visualization of program ancestry, which shows the parent-child and sibling relationships among the processes1. You can also see the event types and timestamps for each process1.
NEW QUESTION # 42
What action is used when you want to save a prevention hash for later use?
- A. Always Allow
- B. Always Block
- C. Never Block
- D. No Action
Answer: B
Explanation:
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, the Always Block action allows you to block a file from executing on any host in your organization based on its hash value2. This action can be used to prevent known malicious files from running on your endpoints2.
NEW QUESTION # 43
You are reviewing the raw data in an event search from a detection tree. You find a FileOpenlnfo event and want to find out if any other files were opened by the responsible process. Which two field values do you need from this event to perform a Process Timeline search?
- A. ContextProcessld_decimal and aid
- B. TargetProcessld_decimal and aid
- C. ParentProcessld_decimal and aid
- D. ResponsibleProcessld_decimal and aid
Answer: B
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Process Timeline tool allows you to view all cloudable events associated with a given process, such as process creation, network connections, file writes, registry modifications, etc2. The tool requires two parameters: aid (agent ID) and TargetProcessId_decimal (the decimal value of the process ID)2. These fields can be obtained from any event that involves the process, such as a FileOpenInfo event, which contains information about a file being opened by a process2.
NEW QUESTION # 44
Which is TRUE regarding a file released from quarantine?
- A. It is allowed to execute on all hosts
- B. No executions are allowed for 14 days after release
- C. It will not generate future machine learning detections on the associated host
- D. It is deleted
Answer: A
Explanation:
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, when you release a file from quarantine, you are restoring it to its original location and allowing it to execute on any host in your organization2. This action also removes the file from the quarantine list and deletes it from the CrowdStrike Cloud2.
NEW QUESTION # 45
Which of the following tactic and technique combinations is sourced from MITRE ATT&CK information?
- A. Credential Access via OS Credential Dumping
- B. Machine Learning via Cloud-Based ML
- C. Malware via PUP
- D. Falcon Intel via Intelligence Indicator - Domain
Answer: A
Explanation:
Explanation
According to the [MITRE ATT&CK website], MITRE ATT&CK is a knowledge base of adversary behaviors and techniques based on real-world observations. The knowledge base is organized into tactics and techniques, where tactics are the high-level goals of an adversary, such as initial access, persistence, lateral movement, etc., and techniques are the specific ways an adversary can achieve those goals, such as phishing, credential dumping, remote file copy, etc. Credential Access via OS Credential Dumping is an example of a tactic and technique combination sourced from MITRE ATT&CK information, which describes how adversaries can obtain credentials from operating system memory or disk storage by using tools such as Mimikatz or ProcDump.
NEW QUESTION # 46
How are processes on the same plane ordered (bottom 'VMTOOLSD.EXE' to top CMD.EXE')?
- A. Process ID (Ascending, highest on top)
- B. Time started (Descending, most recent on bottom)
- C. Process ID (Descending, highest on bottom)
- D. Time started (Ascending, most recent on top)
Answer: B
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the process tree view provides a visualization of program ancestry, which shows the parent-child and sibling relationships among the processes1. You can also see the event types and timestamps for each process1. The processes on the same plane are ordered by time started in descending order, meaning that the most recent process is at the bottom and the oldest process is at the top1. For example, in the image you sent me, CMD.EXE is the oldest process and VMTOOLSD.EXE is the most recent process on that plane1.
NEW QUESTION # 47
What happens when a hash is set to Always Block through IOC Management?
- A. Execution is prevented on all hosts by default
- B. The hash is submitted for approval to be blocked from execution once confirmed by Falcon specialists
- C. Execution is prevented and detection alerts are suppressed
- D. Execution is prevented on selected host groups
Answer: A
Explanation:
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, IOC Management allows you to manage indicators of compromise (IOCs), which are artifacts such as hashes, IP addresses, or domains that are associated with malicious activities2. You can set different actions for IOCs, such as Allow, No Action, or Always Block2. When you set a hash to Always Block through IOC Management, you are preventing that file from executing on any host in your organization by default2. This action also generates a detection alert when the file is blocked2.
NEW QUESTION # 48
What happens when you open the full detection details?
- A. The process explorer opens and you're able to view the processes and process relationships
- B. The process explorer opens and the detection copies to the clipboard
- C. The process explorer opens and the Event Search query is run for the detection
- D. Theprocess explorer opens and the detection is removed from the console
Answer: A
Explanation:
Explanation
According to the [CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide], when you open the full detection details from a detection alert or dashboard item, you are taken to a page where you can view detailed information about the detection, such as detection ID, severity, tactic, technique, description, etc. You can also view the events generated by the processes involved in the detection in different ways, such as process tree, process timeline, or process activity. The process tree view is also known as the process explorer, which provides a graphical representation of the process hierarchy and activity. You can view the processes and process relationships by expanding or collapsing nodes in the tree. You can also see the event types and timestamps for each process.
NEW QUESTION # 49
What information is contained within a Process Timeline?
- A. All cloudable process-related events within a given timeframe
- B. A view of activities on Mac or Linux hosts
- C. All cloudable events for a specific host
- D. Only detection process-related events within a given timeframe
Answer: A
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Process Timeline tool allows you to view all cloudable events associated with a given process, such as process creation, network connections, file writes, registry modifications, etc1. You can specify a timeframe to limit the events to a certain period1. The tool works for any host platform, not just Mac or Linux1.
NEW QUESTION # 50
You are notified by a third-party that a program may have redirected traffic to a malicious domain. Which Falcon page will assist you in searching for any domain request information related to this notice?
- A. Spotlight
- B. Discover
- C. Falcon X
- D. Investigate
Answer: D
Explanation:
Explanation
According to the [CrowdStrike website], the Investigate page is where you can search for and analyze various types of data collected by the Falcon platform, such as events, hosts, processes, hashes, domains, IPs, etc1. You can use various tools, such as Event Search, Host Search, Process Timeline, Hash Search, Bulk Domain Search, etc., to perform different types of searches and view the results in different ways1. If you want to search for any domain request information related to a notice from a third-party, you can use the Investigate page to do so1. For example, you can use the Bulk Domain Search tool to search for the malicious domain and see which hosts and processes communicated with it1. You can also use the Event Search tool to search for DNSRequest events that contain the malicious domain and see more details about the query and response1.
NEW QUESTION # 51
What happens when you create a Sensor Visibility Exclusion for a trusted file path?
- A. It excludes host information from Detections and Incidents generated within that file path location
- B. It prevents file uploads to the CrowdStrike cloud from that file path
- C. It excludes sensor monitoring and event collection for the trusted file path
- D. It disables detection generation from that path, however the sensor can still perform prevention actions
Answer: C
Explanation:
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, Sensor Visibility Exclusions allow you to exclude certain files or directories from being monitored by the CrowdStrike sensor, which can reduce noise and improve performance2. This means that no events will be collected or sent to the CrowdStrike Cloud for those files or directories2.
NEW QUESTION # 52
The Bulk Domain Search tool contains Domain information along with which of the following?
- A. Port Information
- B. Threat Actor Information
- C. Process Information
- D. IP Lookup Information
Answer: D
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Bulk Domain Search tool allows you to search for one or more domains and view a summary of information from Falcon events that contain those domains1. The summary includes the domain name, IP address, country, city, ISP, ASN, geolocation, hostname, sensor ID, OS, process name, command line, and organizational unit of the host that communicated with those domains1. This means that the tool contains domain information along with IP lookup information1.
NEW QUESTION # 53
......
Exam Questions for CCFR-201 Updated Versions With Test Engine: https://www.actualtests4sure.com/CCFR-201-test-questions.html
Test Engine to Practice Test for CCFR-201 Valid and Updated Dumps: https://drive.google.com/open?id=1IYu1TvH_os_b1DrjRbLKIxLlh_8M20hb
