CCFR-201b Exam Dumps - CrowdStrike Certified Falcon Responder

Searching for workable clues to ace the CrowdStrike CCFR-201b Exam? You’re on the right place! ExamCert has realistic, trusted and authentic exam prep tools to help you achieve your desired credential. ExamCert’s CCFR-201b PDF Study Guide, Testing Engine and Exam Dumps follow a reliable exam preparation strategy, providing you the most relevant and updated study material that is crafted in an easy to learn format of questions and answers. ExamCert’s study tools aim at simplifying all complex and confusing concepts of the exam and introduce you to the real exam scenario and practice it with the help of its testing engine and real exam dumps

Go to page:

<< First
Prev
1
2
3
4
5
6
7
8
Next
Last >>

Question # 9

A responder has identified a suspicious PowerShell script executing on a domain controller. To perform a deep-dive forensic analysis of every action taken by that specific processâ€”including network connections and file modificationsâ€”the analyst needs to pivot to a Process Timeline. What is the absolute minimum telemetry data required to generate this auto-filled view?

Agent ID (AID) and Local IP Address

Agent ID (AID) and Target Process ID (TargetProcessId_decimal)

Hostname and MAC Address

User SID and SHA256 Hash

Full Access

Question # 10

After an investigation, the following malicious artifacts have been identified:

C:\Users*\AppData\iamnotmalware.exe

C:\Users*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iamnotmalware.lnk

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iamnotmalware_really

What method will remove all associated artifacts from hosts that trigger future related detections?

Create a Quarantine Rule that will quarantine all identified artifacts across the entire environment

Create Custom IOA rules to prevent the execution of these artifacts

Create a workflow to trigger on a new endpoint detection, query the telemetry data of the endpoint for known artifacts, and select Remove All Associated Artifacts as an action

Create a workflow to trigger on a new endpoint detection, conditions that match the detection, and as an action a PowerShell script to kill associated processes and remove all artifacts

Full Access

Question # 11

A responder releases a file from quarantine on a specific workstation. What is the default scope of the allowlist that is created during this process?

Global (applies to all hosts in the environment)

Only the specific host where the file was originally quarantined

All hosts within the same host group as the source host

All hosts running the same operating system version

Full Access

Question # 12

You are notified by a third-party that a program may have redirected traffic to a malicious domain. Which Falcon page will assist you in searching for any domain request information related to this notice?

Falcon X

Investigate

Discover

Spotlight

Full Access

Question # 13

An analyst needs to perform local sandbox analysis on a malicious file. When they download a quarantined file from the Falcon UI, what is the file format and the default password?

.zip, password: crowdstrike

.7-zip, password: infected

.rar, password: malware

.exe, no password

Full Access

Question # 14

When examining a detection process tree, several fields are provided to give context. Which of the following is NOT included in the standard fields of a detection process tree?

Command Line

User Name

HTTP Post contents

SHA256 Hash

Full Access

Question # 15

Evaluate the following process tree observed in a detection:

root > smss.exe > winlogon.exe > userinit.exe > explorer.exe > windows_media_player_y35s21-4ak.exe

Based on the parent-child relationships, which entry source is most likely?

A remote service exploitation targeting a system process.

A phishing attack where the user executed a malicious file from the desktop.

A scheduled task running under the SYSTEM account.

A supply chain attack targeting the Windows Boot manager.

Full Access

Question # 16

When navigating the main ' Detections ' page, several filters are available in the dropdown menu. Which of the following is NOT a filter available in this menu?

Severity

Tactic

Location tag

Status

Full Access

Go to page: