(Jan-2024) Get professional help from our CCFR-201 Dumps PDF [Q26-Q47]

Rate this post

(Jan-2024) Get professional help from our CCFR-201 Dumps PDF

Give You Free Regular Updates on CCFR-201 Exam Questions

Q26. Which of the following is an example of a MITRE ATT&CK tactic?

Eternal Blue

Defense Evasion

Emotet

Phishing

Q27. How does a DNSRequest event link to its responsible process?

Via both its ContextProcessld__decimal and ParentProcessld_decimal fields

Via its ParentProcessld_decimal field

Via its ContextProcessld_decimal field

Via its TargetProcessld_decimal field

Q28. What does pivoting to an Event Search from a detection do?

It gives you the ability to search for similar events on other endpoints quickly

It takes you to the raw Insight event data and provides you with a number of Event Actions

It takes you to a Process Timeline for that detection so you can see all related events

It allows you to input an event type, such as DNS Request or ASEP write, and search for those events within the detection

Q29. How long does detection data remain in the CrowdStrike Cloud before purging begins?

90 Days

45 Days

14 Days

30 Days

Q30. Which of the following is returned from the IP Search tool?

IP Summary information from Falcon events containing the given IP

Threat Graph Data for the given IP from Falcon sensors

Unmanaged host data from system ARP tables for the given IPD.IP Detection Summary information for detection events containing the given IP

Q31. How long are quarantined files stored on the host?

45 Days

30 Days

Quarantined files are never deleted from the host

90 Days

Q32. From the Detections page, how can you view ‘in-progress’ detections assigned to Falcon Analyst Alex?

Filter on’Analyst: Alex’

Alex does not have the correct role permissions as a Falcon Analyst to be assigned detections

Filter on ‘Hostname: Alex’ and ‘Status: In-Progress’

Filter on ‘Status: In-Progress’ and ‘Assigned-to: Alex*

Q33. When looking at the details of a detection, there are two fields called Global Prevalence and Local Prevalence.
Which answer best defines Local Prevalence?

Local prevalence is the frequency with which the hash of the triggering file is seen across the entire Internet

Local Prevalence tells you how common the hash of the triggering file is within your environment (CID)

Local Prevalence is the Virus Total score for the hash of the triggering file

Local prevalence is the frequency with which the hash of the triggering file is seen across all CrowdStrike customer environments

Q34. The function of Machine Learning Exclusions is to___________.

stop all detections for a specific pattern ID

stop all sensor data collection for the matching path(s)

Stop all Machine Learning Preventions but a detection will still be generated and files will still be uploaded to the CrowdStrike Cloud

stop all ML-based detections and preventions for the matching path(s) and/or stop files from being uploaded to the CrowdStrike Cloud

Q35. Sensor Visibility Exclusion patterns are written in which syntax?

Glob Syntax

Kleene Star Syntax

RegEx

SPL(Splunk)

Q36. In the Hash Search tool, which of the following is listed under Process Executions?

Operating System

File Signature

Command Line

Sensor Version

Q37. What is an advantage of using the IP Search tool?

IP searches provide manufacture and timezone data that can not be accessed anywhere else

IP searches allow for multiple comma separated IPv6 addresses as input

IP searches offer shortcuts to launch response actions and network containment on target hosts

IP searches provide host, process, and organizational unit data without the need to write a query

Q38. What is the difference between Managed and Unmanaged Neighbors in the Falcon console?

A managed neighbor is currently network contained and an unmanaged neighbor is uncontained

A managed neighbor has an installed and provisioned sensor

An unmanaged neighbor is in a segmented area of the network

A managed sensor has an active prevention policy

Q39. What is the difference between a Host Search and a Host Timeline?

Results from a Host Search return information in an organized view by type, while a Host Timeline returns a view of all events recorded by the sensor

A Host Timeline only includes process execution events and user account activity

Results from a Host Timeline include process executions and related events organized by data type. A Host Search returns a temporal view of all events for the given host

There is no difference – Host Search and Host Timeline are different names for the same search page

Q40. Which statement is TRUE regarding the “Bulk Domains” search?

It will show a list of computers and process that performed a lookup of any of the domains in your search

The “Bulk Domains” search will allow you to blocklist your queried domains

The “Bulk Domains” search will show IP address and port information for any associated connectionsD.You should only pivot to the “Bulk Domains” search tool after completing an investigation

Q41. Which is TRUE regarding a file released from quarantine?

No executions are allowed for 14 days after release

It is allowed to execute on all hosts

It is deleted

It will not generate future machine learning detections on the associated host

Q42. Which option indicates a hash is allowlisted?

No Action

Allow

Ignore

Always Block

Q43. Which is TRUE regarding a file released from quarantine?

It is allowed to execute on all hosts

It is deleted

No executions are allowed for 14 days after release

It will not generate future machine learning detections on the associated host

Q44. What happens when a quarantined file is released?

It is moved into theC:CrowdStrikeQuarantineReleasedfolder on the host

It is allowed to execute on the host

It is deleted

It is allowed to execute on all hosts

Q45. The Bulk Domain Search tool contains Domain information along with which of the following?

Process Information

Port Information

IP Lookup Information

Threat Actor Information

Q46. What happens when a hash is set to Always Block through IOC Management?

Execution is prevented on all hosts by default

Execution is prevented on selected host groups

Execution is prevented and detection alerts are suppressed

The hash is submitted for approval to be blocked from execution once confirmed by Falcon specialists

Q47. After pivoting to an event search from a detection, you locate the ProcessRollup2 event. Which two field values are you required to obtain to perform a Process Timeline search so you can determine what the process was doing?

SHA256 and TargetProcessld_decimal

SHA256 and ParentProcessld_decimal

aid and ParentProcessld_decimal

aid and TargetProcessld_decimal