CrowdStrike CCFR-201b CrowdStrike Certified Falcon Responder Exam Practice Test
CrowdStrike Certified Falcon Responder Questions and Answers
What is the difference between Managed and Unmanaged Neighbors in the Falcon console?
Aside from a Process Timeline or Event Search, how do you export process event data from a detection in .CSV format?
The MITRE-Based Falcon Detections Framework is a core component of the Falcon UI. What is the primary operational advantage provided by this framework to a Tier 1 responder?
An analyst needs to perform local sandbox analysis on a malicious file. When they download a quarantined file from the Falcon UI, what is the file format and the default password?
An administrator needs to download a file for analysis that was blocked by the sensor. Where are quarantine files located within the Falcon UI?
Which tool or search type is recommended as the " best search " to use when performing the " Examine what ' s normal for this system " step in an investigation?
Responders often use Process Explorer to visualize process behavior. Which of the following is NOT a valid way to pivot to a Process Explorer view?
Falcon limits the number of detections displayed to prevent the UI from becoming overwhelmed. How many detections are displayed per day per Agent ID (AID)?
In various telemetry events like ' FileWrite ' or ' NetworkConnect ' , Falcon identifies the process that performed the action. Which field will always identify this " acting " process?
An analyst notices a detection that has been automatically flagged with the ' New Activity ' status. Which of the following statements best describes what this status indicates?
In the Hash Search tool, which of the following is listed under Process Executions?
You are writing a script that your colleagues could run on any Windows machine using Real Time Response (RTR). The script you have written is over the 40-KB limit.
How should you run the script to avoid technical issues?
A responder is explaining the quarantine process to a system administrator. What happens technically when a file is quarantined by the Falcon sensor?
While reviewing the high-level organizational structure of a complex detection in the Falcon console, a responder identifies several layers of activity. Which of the following is NOT officially recognized as an Objective Layer within the CrowdStrike detection hierarchy?
A responder releases a file from quarantine on a specific workstation. What is the default scope of the allowlist that is created during this process?
A responder decides to set a specific Custom IOA to the ' Monitor ' action. Which of the following sentences best describes the technical result of this choice?
Executive dashboards provide a high-level view of security. Which of the following CANNOT be seen from the Executive Summary Dashboard?
What does pivoting to an Event Search from a detection do?
A responder is using ' Host Search ' to gather baseline data on a machine. Which of the following pieces of information is NOT provided by the Host Search results?
While quarantined files stay on the local host for 30 days by default, how many days does a quarantined file remain stored in the CrowdStrike Cloud?
An analyst wants to see the raw events behind a specific detection. Which icon in the UI allows them to pivot directly to an event search?
When reviewing open detections, what method should be used to identify the most relevant related information in the environment?
When an analyst is trying to pinpoint the exact moment an endpoint came online after being shut down for the weekend, which timeline view is the best to use?
Which of the following sentences best describes the technical visibility provided by the ' Host Timeline ' view?
A responder needs to categorize an incident based on the high-level goals of the attacker. Which of the following lists correctly identifies the " Objectives " as they are natively defined and used within the Falcon platform?
While investigating a detection, you pivot to the Advanced Event Search.
Which field would you filter by to return events executing from a specific directory on the host?
What are Event Actions?
Which of the following is an example of a MITRE ATT AND CK tactic?
While most searches are accessible from a detection, some require a manual jump. Which search is not available as a direct pivot from a detection?
You have a folder with the path C:\Windows\BadTools.
Using native Real Time Response (RTR) commands, what is the correct syntax to remove the folder and all of its contents?
A responder needs to find a specific sequence of network connections that did not trigger a detection. Which search tool allows them to search for anything within the raw telemetry?
Evaluate the following process tree observed in a detection:
root > smss.exe > winlogon.exe > userinit.exe > explorer.exe > windows_media_player_y35s21-4ak.exe
Based on the parent-child relationships, which entry source is most likely?
Administrators can define their own criteria for alerts. Which of the following is an example of a custom detection within the Falcon platform?
The Process Activity View provides a rows-and-columns style view of the events generated in a detection. Why might this be helpful?
In the ' User Search - File Written ' section, a responder can see various files dropped by a user. Which of the following file types CANNOT be seen from this view?
You are pre-staging a Custom IOC for later use and want to save a file hash for later use after approval.
Which action should you use?
You notice that taskeng.exe is one of the processes involved in a detection. What activity should you investigate next?
To speed up investigations, Falcon uses ' event workflows ' . Which of the following sentences best describes what event workflows are?
An analyst needs to quickly view the activity surrounding a suspicious process. Which of the following sequences of steps will pivot to an auto-filled process timeline in the Falcon UI?
An executive asks for a definition of ' CrowdScore ' . Which of the following sentences best describes what CrowdScore is?
Which option indicates a hash is allowlisted?
While examining the ' Process Details ' sidebar of a detection, a responder sees the following icons: " 25 Network Operations " and " 277 Disk Operations " . What does this contextual data represent?
Sensor Visibility Exclusion patterns are written in which syntax?
When a responder chooses to ' Release ' a file from quarantine because it was determined to be a false positive, what type of allowlist is automatically created in the background?
A responder has identified a suspicious PowerShell script executing on a domain controller. To perform a deep-dive forensic analysis of every action taken by that specific process—including network connections and file modifications—the analyst needs to pivot to a Process Timeline. What is the absolute minimum telemetry data required to generate this auto-filled view?
During the triage of a detection involving a newly created persistent task, which specific indicator is most important for a responder to identify the actual intent of the service?
Filtering the ' Detection Activity ' report is useful for identifying specific threats. Which of the following filters can not be used on ' Detection Activity ' ?
To perform a deep-dive investigation into a specific detection, a responder needs to pivot to a process timeline. What is the minimum information required to be gathered from the detection before making this pivot?
What actions are available for domain name-based Indicators of Compromise (IOCs) in Falcon?
In the full detection tree view, icons provide visual cues about the telemetry. What does the specific icon representing a ' Falcon ' (blue bird) indicate to the responder?
Which of the following subtitles/sub-views cannot be seen in the results of a ' Hash Search ' ?
When is a SyntheticProcessRollup2 event type found?
A responder is looking at event telemetry and sees an event named ' ProcessRollup2 ' . Which sentence best describes what this event type represents?
Responders use ' IP Search ' to track connections to malicious infrastructure. Which of the following statements about the IP Search is FALSE?
A responder is analyzing a MITRE-related alert and sees the technique ' Explore > Discovery > Cloud Service Dashboard ' . Which of the following scenarios best describes the technical activity associated with this technique?
When viewing the summary list on the ' Endpoint Detections ' page, an analyst sees a column for the timestamp. What does the timestamp in this specific summary view represent?
If the Falcon sensor identifies suspicious behavioral patterns—such as a process attempting to dump memory from lsass.exe—what specific type of detection will be generated?
CrowdScore is a metric used to identify the severity of an ongoing incident. What percentage of increase in a CrowdScore is considered a strong indication of a coordinated attack?
What do IOA exclusions help you achieve?
The Falcon sensor can automatically upload quarantined files to the CrowdStrike Cloud for further analysis. What is the maximum size allowed for a quarantined file to be uploaded?
If a local administrator needs to inspect the quarantine directory directly on a machine, where are quarantine files located on a Windows Endpoint?
When examining a detection process tree, several fields are provided to give context. Which of the following is NOT included in the standard fields of a detection process tree?