CrowdStrike CCFR-201 CrowdStrike Certified Falcon Responder Exam Exam Practice Test Questions

• Question 1

  What types of events are returned by a Process Timeline?

  • Only detection events
  • All cloudable events
  • Only process events
  • Only network events

  Show Answer Answer: B Next

• Question 2

  What information does the MITRE ATT&CK ® Framework provide?

  • It provides best practices for different cybersecurity domains, such as Identify and Access Management
  • It provides a step-by-step cyber incident response strategy
  • It provides the phases of an adversary's lifecycle, the platforms they are known to attack, and the specific methods they use
  • It is a system that attributes an attack techniques to a specific threat actor

  Show Answer Answer: C Next

• Question 3

  The Falcon platform will show a maximum of how many detections per day for a single Agent Identifier (AID)?

  • 500
  • 750
  • 1000
  • 1200

  Show Answer Answer: C Next

• Question 4

  From the Detections page, how can you view 'in-progress' detections assigned to Falcon Analyst Alex?

  • Filter on'Analyst: Alex'
  • Alex does not have the correct role permissions as a Falcon Analyst to be assigned detections
  • Filter on 'Hostname: Alex' and 'Status: In-Progress'
  • Filter on 'Status: In-Progress' and 'Assigned-to: Alex*

  Show Answer Answer: D Next

• Question 5

  You notice that taskeng.exe is one of the processes involved in a detection. What activity should you investigate next?

  • User logons after the detection
  • Executions of schtasks.exe after the detection
  • Scheduled tasks registered prior to the detection
  • Pivot to a Hash search for taskeng.exe

  Show Answer Answer: C Next