Verified CCFR-201 dumps Q&As - 2024 Latest CCFR-201 Download
Dumps Questions [2024] Pass for CCFR-201 Exam
NEW QUESTION # 27
When reviewing a Host Timeline, which of the following filters is available?
- A. User Name
- B. Detection ID
- C. Severity
- D. Event Types
Answer: D
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Host Timeline tool allows you to view all events recorded by the sensor for a given host in a chronological order1. The events include process executions, file writes, registry modifications, network connections, user logins, etc1. You can use various filters to narrow down the events based on criteria such as event type, timestamp range, file name, registry key, network destination, etc1. However, there is no filter for severity, user name, or detection ID, as these are not attributes of the events1.
NEW QUESTION # 28
The Falcon platform will show a maximum of how many detections per day for a single Agent Identifier (AID)?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: A
Explanation:
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, the Falcon platform will show a maximum of 1000 detections per day for a single AID1. This is a limitimposed by the Falcon API, which is used to retrieve the detections from the CrowdStrike Cloud1. If there are more than 1000 detections per day for a single AID, only the first 1000 will be shown1.
NEW QUESTION # 29
Which is TRUE regarding a file released from quarantine?
- A. It is allowed to execute on all hosts
- B. It is deleted
- C. No executions are allowed for 14 days after release
- D. It will not generate future machine learning detections on the associated host
Answer: A
Explanation:
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, when you release a file from quarantine, you are restoring it to its original location and allowing it to execute on any host in your organization2. This action also removes the file from the quarantine list and deletes it from the CrowdStrike Cloud2.
NEW QUESTION # 30
Which of the following is an example of a MITRE ATT&CK tactic?
- A. Emotet
- B. Phishing
- C. Defense Evasion
- D. Eternal Blue
Answer: C
Explanation:
Explanation
According to the [MITRE ATT&CK website], MITRE ATT&CK is a knowledge base of adversary behaviors and techniques based on real-world observations. The knowledge base is organized into tactics and techniques, where tactics are the high-level goals of an adversary, such as initial access, persistence, lateral movement, etc., and techniques are the specific ways an adversary can achieve those goals, such as phishing, credential dumping, remote file copy, etc. Defense Evasion is one of the tactics defined by MITRE ATT&CK, which covers actions that adversaries take to avoid detection or prevent security controls from blocking their activities. Eternal Blue, Emotet, and Phishing are examples of techniques, not tactics.
NEW QUESTION # 31
You notice that taskeng.exe is one of the processes involved in a detection. What activity should you investigate next?
- A. User logons after the detection
- B. Scheduled tasks registered prior to the detection
- C. Executions of schtasks.exe after the detection
- D. Pivot to a Hash search for taskeng.exe
Answer: B
Explanation:
Explanation
According to the [Microsoft website], taskeng.exe is a legitimate Windows process that is responsible for running scheduled tasks. However, some malware may use this process or create a fake one to execute malicious code. Therefore, if you notice taskeng.exe involved in a detection, you should investigate whether there are any scheduled tasks registered prior to the detection that may have triggered or injected into taskeng.exe. You can use tools such as schtasks.exe or Task Scheduler to view or manage scheduled tasks.
NEW QUESTION # 32
What happens when you open the full detection details?
- A. The process explorer opens and the Event Search query is run for the detection
- B. The process explorer opens and the detection copies to the clipboard
- C. Theprocess explorer opens and the detection is removed from the console
- D. The process explorer opens and you're able to view the processes and process relationships
Answer: D
Explanation:
Explanation
According to the [CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide], when you open the full detection details from a detection alert or dashboard item, you are taken to a page where you can view detailed information about the detection, such as detection ID, severity, tactic, technique, description, etc. You can also view the events generated by the processes involved in the detection in different ways, such as process tree, process timeline, or process activity. The process tree view is also known as the process explorer, which provides a graphical representation of the process hierarchy and activity. You can view the processes and process relationships by expanding or collapsing nodes in the tree. You can also see the event types and timestamps for each process.
NEW QUESTION # 33
From a detection, what is the fastest way to see children and sibling process information?
- A. Select the Event Search option. Then from the Event Actions, select Show Associated Event Data (From TargetProcessld_decimal)
- B. Right-click the process and select "Follow Process Chain"
- C. Select Full Detection Details from the detection
- D. Select the Process Timeline feature, enter the AID. Target Process ID, and Parent Process ID
Answer: C
Explanation:
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, the Full Detection Details tool allows you to view detailed information about a detection, such as detection ID, severity, tactic, technique, description, etc1. You can also view the events generated by the processes involved in the detection in different ways, such as process tree, process timeline, or process activity1. The process tree view provides a graphical representation of the process hierarchy and activity1. You can see children and sibling processes information by expanding or collapsing nodes in the tree1.
NEW QUESTION # 34
From the Detections page, how can you view 'in-progress' detections assigned to Falcon Analyst Alex?
- A. Filter on 'Status: In-Progress' and 'Assigned-to: Alex*
- B. Filter on'Analyst: Alex'
- C. Alex does not have the correct role permissions as a Falcon Analyst to be assigned detections
- D. Filter on 'Hostname: Alex' and 'Status: In-Progress'
Answer: A
Explanation:
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, the Detections page allows you to view and manage detections generated by the CrowdStrike Falcon platform2. You can use various filters to narrow down the detections based on criteria such asstatus, severity, tactic, technique, etc2. To view 'in-progress' detections assigned to Falcon Analyst Alex, you can filter on 'Status: In-Progress' and 'Assigned-to: Alex*'2. The asterisk (*) is a wildcard that matches any characters after Alex2.
NEW QUESTION # 35
What happens when you create a Sensor Visibility Exclusion for a trusted file path?
- A. It excludes host information from Detections and Incidents generated within that file path location
- B. It excludes sensor monitoring and event collection for the trusted file path
- C. It prevents file uploads to the CrowdStrike cloud from that file path
- D. It disables detection generation from that path, however the sensor can still perform prevention actions
Answer: B
Explanation:
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, Sensor Visibility Exclusions allow you to exclude certain files or directories from being monitored by the CrowdStrike sensor, which can reduce noise and improve performance2. This means that no events will be collected or sent to the CrowdStrike Cloud for those files or directories2.
NEW QUESTION # 36
What happens when a hash is set to Always Block through IOC Management?
- A. Execution is prevented on all hosts by default
- B. The hash is submitted for approval to be blocked from execution once confirmed by Falcon specialists
- C. Execution is prevented on selected host groups
- D. Execution is prevented and detection alerts are suppressed
Answer: A
Explanation:
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, IOC Management allows you to manage indicators of compromise (IOCs), which are artifacts such as hashes, IP addresses, or domains that are associated with malicious activities2. You can set different actions for IOCs, such as Allow, No Action, or Always Block2. When you set a hash to Always Block through IOC Management, you are preventing that file from executing on any host in your organization by default2. This action also generates a detection alert when the file is blocked2.
NEW QUESTION # 37
You are notified by a third-party that a program may have redirected traffic to a malicious domain. Which Falcon page will assist you in searching for any domain request information related to this notice?
- A. Investigate
- B. Discover
- C. Falcon X
- D. Spotlight
Answer: A
Explanation:
Explanation
According to the [CrowdStrike website], the Investigate page is where you can search for and analyze various types of data collected by the Falcon platform, such as events, hosts, processes, hashes, domains, IPs, etc1. You can use various tools, such as Event Search, Host Search, Process Timeline, Hash Search, Bulk Domain Search, etc., to perform different types of searches and view the results in different ways1. If you want to search for any domain request information related to a notice from a third-party, you can use the Investigate page to do so1. For example, you can use the Bulk Domain Search tool to search for the malicious domain and see which hosts and processes communicated with it1. You can also use the Event Search tool to search for DNSRequest events that contain the malicious domain and see more details about the query and response1.
NEW QUESTION # 38
Sensor Visibility Exclusion patterns are written in which syntax?
- A. SPL(Splunk)
- B. Glob Syntax
- C. Kleene Star Syntax
- D. RegEx
Answer: B
Explanation:
Explanation
According to the [CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide], Sensor Visibility Exclusions allow you to exclude files or directories from being monitored by the sensor. This can reduce the amount of data sent to the CrowdStrike Cloud and improve performance. Sensor Visibility Exclusion patterns are written in Glob Syntax, which is a simple pattern matching syntax that supports wildcards, such as *, ?, and . For example, you can use *.exe to exclude all files with .exe extension.
NEW QUESTION # 39
You receive an email from a third-party vendor that one of their services is compromised,thevendor names a specific IP address that the compromised service was using. Where would you input this indicator to find any activity related to this IP address?
- A. IP Addresses
- B. Remote or Network Logon Activity
- C. Hash Executions
- D. Remote Access Graph
Answer: A
Explanation:
Explanation
According to the [CrowdStrike website], the Discover page is where you can search for and analyze various types of indicators of compromise (IOCs), such as hashes, IP addresses, or domains that are associated with malicious activities. You can use various tools, such as Hash Executions, IP Addresses, Remote or Network Logon Activity, etc., to perform different types of searches and view the results in different ways. If you want to search for any activity related to an IP address that was compromised by a third-party vendor, you can use the IP Addresses tool to do so. You can input the IP address and see a summary of information from Falcon events that contain that IP address, such as hostname, sensor ID, OS, country, city, ISP, ASN, geolocation, process name, command line, and organizational unit of the host that communicated with that IP address.
NEW QUESTION # 40
Which is TRUE regarding a file released from quarantine?
- A. It is allowed to execute on all hosts
- B. It is deleted
- C. No executions are allowed for 14 days after release
- D. It will not generate future machine learning detections on the associated host
Answer: A
Explanation:
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, when you release a file from quarantine, you are restoring it to its original location and allowing it to execute on any host in your organization2. This action also removes the file from the quarantine list and deletes it from the CrowdStrike Cloud2.
NEW QUESTION # 41
What is the difference between Managed and Unmanaged Neighbors in the Falcon console?
- A. A managed neighbor is currently network contained and an unmanaged neighbor is uncontained
- B. A managed sensor has an active prevention policy
- C. A managed neighbor has an installed and provisioned sensor
- D. An unmanaged neighbor is in a segmented area of the network
Answer: C
Explanation:
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, you can use the Hosts page in the Investigate tool to view information about your endpoints, such as hostname, IP address, OS, sensor version, etc2. You can also see a list of managed and unmanaged neighbors for each endpoint, which are other devices that have communicated with that endpoint over the network2. A managed neighbor is a device that has an installed and provisioned sensor that reports to the CrowdStrike Cloud2. An unmanaged neighbor is a device that does not have an installed or provisioned sensor2.
NEW QUESTION # 42
What is an advantage of using the IP Search tool?
- A. IP searches allow for multiple comma separated IPv6 addresses as input
- B. IP searches offer shortcuts to launch response actions and network containment on target hosts
- C. IP searches provide host, process, and organizational unit data without the need to write a query
- D. IP searches provide manufacture and timezone data that can not be accessed anywhere else
Answer: C
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the IP Search tool allows you to search for an IP address and view a summary of information from Falcon events that contain that IP address1. The summary includes the hostname, sensor ID, OS, country, city, ISP, ASN, geolocation, process name, command line, and organizational unit of the host that communicated with that IP address1. This is an advantage of using the IP Search tool because it provides host, process, and organizational unit data without the need to write a query1.
NEW QUESTION # 43
What are Event Actions?
- A. Automated searches that can be used to pivot between related events and searches
- B. Custom event data queries bookmarked by the currently signed in Falcon user
- C. Pivotable hyperlinks available in a Host Search
- D. Raw Falcon event data
Answer: A
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, Event Actions are automated searches that can be used to pivot between related events and searches1. They are available in various tools, such as Event Search, Process Timeline, Host Timeline, etc1. You can select one or more events and perform various actions, such as show a process timeline, show a host timeline, show associated event data, show a +/- 10-minute window of events, etc1. These actions can help you investigate and analyze events more efficiently and effectively1.
NEW QUESTION # 44
Which of the following is NOT a valid event type?
- A. StartofProcess
- B. EndofProcess
- C. ProcessRollup2
- D. DnsRequest
Answer: B
Explanation:
Explanation
According to the [CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+], event types are categories of events that are generated by the sensor for various activities, such as process executions, file writes, registry modifications, network connections, etc. There are many valid event types, such as StartOfProcess, ProcessRollup2, DnsRequest, etc. However, EndOfProcess is not a valid event type, as there is no such event that records the end of a process.
NEW QUESTION # 45
Which of the following tactic and technique combinations is sourced from MITRE ATT&CK information?
- A. Falcon Intel via Intelligence Indicator - Domain
- B. Machine Learning via Cloud-Based ML
- C. Credential Access via OS Credential Dumping
- D. Malware via PUP
Answer: C
Explanation:
Explanation
According to the [MITRE ATT&CK website], MITRE ATT&CK is a knowledge base of adversary behaviors and techniques based on real-world observations. The knowledge base is organized into tactics and techniques, where tactics are the high-level goals of an adversary, such as initial access, persistence, lateral movement, etc., and techniques are the specific ways an adversary can achieve those goals, such as phishing, credential dumping, remote file copy, etc. Credential Access via OS Credential Dumping is an example of a tactic and technique combination sourced from MITRE ATT&CK information, which describes how adversaries can obtain credentials from operating system memory or disk storage by using tools such as Mimikatz or ProcDump.
NEW QUESTION # 46
What action is used when you want to save a prevention hash for later use?
- A. Never Block
- B. Always Block
- C. Always Allow
- D. No Action
Answer: B
Explanation:
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, the Always Block action allows you to block a file from executing on any host in your organization based on its hash value2. This action can be used to prevent known malicious files from running on your endpoints2.
NEW QUESTION # 47
When examining a raw DNS request event, you see a field called ContextProcessld_decimal. What is the purpose of that field?
- A. It contains the TargetProcessld_decimal value for other related events
- B. It contains the TargetProcessld_decimal value for the process that made the DNS request
- C. It contains the ContextProcessld_decimal value for the parent process that made the DNS request
- D. It contains an internal value not useful for an investigation
Answer: B
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the ContextProcessld_decimal field contains the decimal value of the process ID of the process that generated the event1. This field can be used to trace the process lineage and identify malicious or suspicious activities1. For a DNS request event, this field indicates which process made the DNS request1.
NEW QUESTION # 48
......
Updated CrowdStrike Study Guide CCFR-201 Dumps Questions: https://skillmeup.examprepaway.com/CrowdStrike/braindumps.CCFR-201.ete.file.html