CCFR-201b Exam Dumps - CrowdStrike Certified Falcon Responder

Searching for workable clues to ace the CrowdStrike CCFR-201b Exam? You’re on the right place! ExamCert has realistic, trusted and authentic exam prep tools to help you achieve your desired credential. ExamCert’s CCFR-201b PDF Study Guide, Testing Engine and Exam Dumps follow a reliable exam preparation strategy, providing you the most relevant and updated study material that is crafted in an easy to learn format of questions and answers. ExamCert’s study tools aim at simplifying all complex and confusing concepts of the exam and introduce you to the real exam scenario and practice it with the help of its testing engine and real exam dumps

Go to page:

<< First
Prev
1
2
3
4
5
6
7
8
Next
Last >>

Question # 57

When performing a ' Hash Search ' , which of the following is NOT a filter available for use?

SHA256

MD5

File Type

Filename

Full Access

Question # 58

To perform a deep-dive investigation into a specific detection, a responder needs to pivot to a process timeline. What is the minimum information required to be gathered from the detection before making this pivot?

The External IP and the Username of the logged-in user.

The Agent ID (AID) and the Target Process ID (TargetProcessId_decimal).

The MAC Address of the host and the SHA256 hash of the file.

The Policy ID and the timestamp of the first event.

Full Access

Question # 59

A list of managed and unmanaged neighbors for an endpoint can be found:

by using Hosts page in the Investigate tool

by reviewing " Groups " in Host Management under the Hosts page

under " Audit " by running Sensor Visibility Exclusions Audit

only by searching event data using Event Search

Full Access

Question # 60

Responders often use Process Explorer to visualize process behavior. Which of the following is NOT a valid way to pivot to a Process Explorer view?

From Detection > Top Right Drop Down > View as Process Activity

From Configuration > Prevention Policies > View Process Explorer

From Event Search > Click on a specific Process ID

From Host Search > Processes and Services list

Full Access

Question # 61

To speed up investigations, Falcon uses ' event workflows ' . Which of the following sentences best describes what event workflows are?

They are automated scripts that perform remediation actions like killing processes.

They are automated searches that can be used to pivot between related events and searches.

They are PDF reports that summarize an incident for executive review.

They are schedules for when the sensor should perform a full disk scan.

Full Access

Question # 62

Refer to the image.

You are using Advanced Event Search to find the event record for a suspicious network connection.

Using the Event List Interactions button for the event, indicated by the arrow in the image above, which option will show all contextual event data around the process execution being investigated?

Show Responsible Process Data

Inspect

Show +/- 10-minute windows of events

Investigate Host

Full Access