CCFR-201b Exam Dumps - CrowdStrike Certified Falcon Responder

Searching for workable clues to ace the CrowdStrike CCFR-201b Exam? You’re on the right place! ExamCert has realistic, trusted and authentic exam prep tools to help you achieve your desired credential. ExamCert’s CCFR-201b PDF Study Guide, Testing Engine and Exam Dumps follow a reliable exam preparation strategy, providing you the most relevant and updated study material that is crafted in an easy to learn format of questions and answers. ExamCert’s study tools aim at simplifying all complex and confusing concepts of the exam and introduce you to the real exam scenario and practice it with the help of its testing engine and real exam dumps

Go to page:

<< First
Prev
1
2
3
4
5
6
7
8
Next
Last >>

Question # 17

While reviewing the ' Detection Method ' field for a high-severity alert, a responder sees the label ' Post-Exploit ' . This terminology is used by CrowdStrike to identify a specific:

Falcon Detection Method

MITRE Tactic

Indicator of Attack (IOA)

Prevention Policy Level

Full Access

Question # 18

What happens when a hash is allowlisted?

Execution is prevented, but detection alerts are suppressed

Execution is allowed on all hosts, including all other Falcon customers

The hash is submitted for approval to be allowed to execute once confirmed by Falcon specialists

Execution is allowed on all hosts that fall under the organization ' s CID

Full Access

Question # 19

After an investigation, the following malicious artifacts have been identified:

C:\Users*\AppData\iamnotmalware.exe

C:\Users*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iamnotmalware.lnk

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iamnotmalware_really

What method will remove all associated artifacts from hosts that trigger future related detections?

Create a Quarantine Rule that will quarantine all identified artifacts across the entire environment

Create Custom IOA rules to prevent the execution of these artifacts

Create a workflow to trigger on a new endpoint detection, query the telemetry data of the endpoint for known artifacts, and select Remove All Associated Artifacts as an action

Create a workflow to trigger on a new endpoint detection, conditions that match the detection, and as an action a PowerShell script to kill associated processes and remove all artifacts

Full Access

Question # 20

Which option indicates a hash is allowlisted?

No Action

Allow

Ignore

Always Block

Full Access

Question # 21

What is the difference between Managed and Unmanaged Neighbors in the Falcon console?

A managed neighbor is currently network contained and an unmanaged neighbor is uncontained

A managed neighbor has an installed and provisioned sensor

An unmanaged neighbor is in a segmented area of the network

A managed sensor has an active prevention policy

Full Access

Question # 22

Where can you find hosts that are in Reduced Functionality Mode?

Event Search

Executive Summary dashboard

Host Search

Installation Tokens

Full Access

Question # 23

A responder is unsure about the difference between ' Detection ' and ' Prevention ' settings. Where can they find information about Detection and Prevention Policies?

On the public CrowdStrike blog.

In the Support page under the Docs section.

By clicking the ' About ' button in the user profile.

In the training videos on the main Dashboard.

Full Access

Question # 24

When viewing the main ' Quarantine ' dashboard to manage blocked files, which of the following pieces of information CANNOT be seen by default?

Filename

Host Name

Hash

Date Quarantined

Full Access