CCFR-201b Exam Dumps - CrowdStrike Certified Falcon Responder

Searching for workable clues to ace the CrowdStrike CCFR-201b Exam? You’re on the right place! ExamCert has realistic, trusted and authentic exam prep tools to help you achieve your desired credential. ExamCert’s CCFR-201b PDF Study Guide, Testing Engine and Exam Dumps follow a reliable exam preparation strategy, providing you the most relevant and updated study material that is crafted in an easy to learn format of questions and answers. ExamCert’s study tools aim at simplifying all complex and confusing concepts of the exam and introduce you to the real exam scenario and practice it with the help of its testing engine and real exam dumps

Go to page:

<< First
Prev
1
2
3
4
5
6
7
8
Next
Last >>

Question # 17

You notice that taskeng.exe is one of the processes involved in a detection. What activity should you investigate next?

User logons after the detection

Executions of schtasks.exe after the detection

Scheduled tasks registered prior to the detection

Pivot to a Hash search for taskeng.exe

Full Access

Question # 18

From the Detections page, how can you view ' in-progress ' detections assigned to Falcon Analyst Alex?

Filter on ' Analyst: Alex '

Alex does not have the correct role permissions as a Falcon Analyst to be assigned detections

Filter on ' Hostname: Alex ' and ' Status: In-Progress '

Filter on ' Status: In-Progress ' and ' Assigned-to: Alex*

Full Access

Question # 19

In the ' User Search - File Written ' section, a responder can see various files dropped by a user. Which of the following file types CANNOT be seen from this view?

Scripts (.ps1, .sh)

Executables (.exe)

Executions (Process starts)

Archive files (.zip, .7z)

Full Access

Question # 20

Where can you find hosts that are in Reduced Functionality Mode?

Event Search

Executive Summary dashboard

Host Search

Installation Tokens

Full Access

Question # 21

The MITRE-Based Falcon Detections Framework is a core component of the Falcon UI. What is the primary operational advantage provided by this framework to a Tier 1 responder?

It allows for the automated decryption of files affected by ransomware.

It provides a standardized view of the attack lifecycle to help understand adversary behavior.

It enables the sensor to block kernel-level drivers from unknown publishers.

It provides a real-time count of the total number of files on the endpoint.

Full Access

Question # 22

An attacker attaches cmd.exe as a debugger to osk.exe through a registry key.

What tactic and technique describe this activity?

Persistence via Image File Execution Options Injection

Post-Exploit via Malicious Tool Execution

Persistence via External Remote Services

Privilege Escalation via Bypass User Account Control