CrowdStrike CCFR-201b Exam Questions Instant Access

Question 1

Which is TRUE regarding a file released from quarantine?

ANo executions are allowed for 14 days after release

BIt is allowed to execute on all hosts

CIt is deleted

DIt will not generate future machine learning detections on the associated host

Answer : B

According to theCrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, when you release a file from quarantine, you are restoring it to its original location and allowing it to execute on any host in your organization2.This action also removes the file from the quarantine list and deletes it from the CrowdStrike Cloud2.

Question 2

The function of Machine Learning Exclusions is to___________.

Astop all detections for a specific pattern ID

Bstop all sensor data collection for the matching path(s)

CStop all Machine Learning Preventions but a detection will still be generated and files will still be uploaded to the CrowdStrike Cloud

Dstop all ML-based detections and preventions for the matching path(s) and/or stop files from being uploaded to the CrowdStrike Cloud

Answer : D

According to theCrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, Machine Learning Exclusions allow you to exclude files or directories from being scanned by CrowdStrike's machine learning engine, which can reduce false positives and improve performance2.You can also choose whether to upload the excluded files to the CrowdStrike Cloud or not2.

Question 3

After running an Event Search, you can select many Event Actions depending on your results. Which of the following is NOT an option for any Event Action?

ADraw Process Explorer

BShow a +/- 10-minute window of events

CShow a Process Timeline for the responsible process

DShow Associated Event Data (from TargetProcessld_decimal or ContextProcessld_decimal)

Answer : A

According to theCrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Event Search tool allows you to search for events based on various criteria, such as event type, timestamp, hostname, IP address, etc1.You can also select one or more events and perform various actions, such as show a process timeline, show a host timeline, show associated event data, show a +/- 10-minute window of events, etc1.However, there is no option to draw a process explorer, which is a graphical representation of the process hierarchy and activity1.

Question 4

What information does the MITRE ATT&CK Framework provide?

AIt provides best practices for different cybersecurity domains, such as Identify and Access Management

BIt provides a step-by-step cyber incident response strategy

CIt provides the phases of an adversary's lifecycle, the platforms they are known to attack, and the specific methods they use

DIt is a system that attributes an attack techniques to a specific threat actor

Answer : C

According to the [MITRE ATT&CK website], MITRE ATT&CK is a knowledge base of adversary behaviors and techniques based on real-world observations. The knowledge base is organized into tactics and techniques, where tactics are the high-level goals of an adversary, such as initial access, persistence, lateral movement, etc., and techniques are the specific ways an adversary can achieve those goals, such as phishing, credential dumping, remote file copy, etc. The knowledge base also covers different platforms that adversaries target, such as Windows, Linux, Mac, Android, iOS, etc., and different phases of an adversary's lifecycle, such as reconnaissance, resource development, execution, command and control, etc.

Question 5

You can jump to a Process Timeline from many views, like a Hash Search, by clicking which of the following?

AProcessTimeline Link

BPID

CUTCtime

DProcess ID or Parent Process ID

Answer : D

According to theCrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Process Timeline tool allows you to view all cloudable events associated with a given process, such as process creation, network connections, file writes, registry modifications, etc1.The tool requires two parameters:aid(agent ID) andTargetProcessId_decimal(the decimal value of the process ID)1.You can jump to a Process Timeline from many views, such as Hash Search, Host Timeline, Event Search, etc., by clicking on either the Process ID or Parent Process ID fields in those views1.This will automatically populate the aid and TargetProcessId_decimal parameters for the Process Timeline tool1.

Question 6

What information is contained within a Process Timeline?

AAll cloudable process-related events within a given timeframe

BAll cloudable events for a specific host

COnly detection process-related events within a given timeframe

DA view of activities on Mac or Linux hosts

Answer : A

Question 7

What is an advantage of using a Process Timeline?

AProcess related events can be filtered to display specific event types

BSuspicious processes are color-coded based on their frequency and legitimacy over time

CProcesses responsible for spikes in CPU performance are displayed overtime

DA visual representation of Parent-Child and Sibling process relationships is provided

Answer : A

According to theCrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Process Timeline tool allows you to view all cloudable events associated with a given process, such as process creation, network connections, file writes, registry modifications, etc2.You can also filter the events by various criteria, such as event type, timestamp range, file name, registry key, network destination, etc2.This is an advantage of using the Process Timeline tool because it allows you to focus on specific events that are relevant to your investigation2.

CrowdStrike Certified Falcon Responder CCFR-201b Exam Questions