Study HIGH Quality CCFR-201 Free Study Guides and Exams Tutorials
Download CrowdStrike CCFR-201 Exam Dumps to Pass Exam Easily
NEW QUESTION # 37
How are processes on the same plane ordered (bottom 'VMTOOLSD.EXE' to top CMD.EXE')?
- A. Time started (Descending, most recent on bottom)
- B. Process ID (Ascending, highest on top)
- C. Process ID (Descending, highest on bottom)
- D. Time started (Ascending, most recent on top)
Answer: A
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the process tree view provides a visualization of program ancestry, which shows the parent-child and sibling relationships among the processes1. You can also see the event types and timestamps for each process1. The processes on the same plane are ordered by time started in descending order, meaning that the most recent process is at the bottom and the oldest process is at the top1. For example, in the image you sent me, CMD.EXE is the oldest process and VMTOOLSD.EXE is the most recent process on that plane1.
NEW QUESTION # 38
You notice that taskeng.exe is one of the processes involved in a detection. What activity should you investigate next?
- A. Executions of schtasks.exe after the detection
- B. Scheduled tasks registered prior to the detection
- C. User logons after the detection
- D. Pivot to a Hash search for taskeng.exe
Answer: B
Explanation:
Explanation
According to the [Microsoft website], taskeng.exe is a legitimate Windows process that is responsible for running scheduled tasks. However, some malware may use this process or create a fake one to execute malicious code. Therefore, if you notice taskeng.exe involved in a detection, you should investigate whether there are any scheduled tasks registered prior to the detection that may have triggered or injected into taskeng.exe. You can use tools such as schtasks.exe or Task Scheduler to view or manage scheduled tasks.
NEW QUESTION # 39
Which of the following is returned from the IP Search tool?
- A. Threat Graph Data for the given IP from Falcon sensors
- B. Unmanaged host data from system ARP tables for the given IPD.IP Detection Summary information for detection events containing the given IP
- C. IP Summary information from Falcon events containing the given IP
Answer: C
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the IP Search tool allows you to search for an IP address and view a summary of information from Falcon events that contain that IP address1. The summary includes the hostname, sensor ID, OS, country, city, ISP, ASN, and geolocation of the host that communicated with that IP address1.
NEW QUESTION # 40
The Falcon platform will show a maximum of how many detections per day for a single Agent Identifier (AID)?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: A
Explanation:
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, the Falcon platform will show a maximum of 1000 detections per day for a single AID1. This is a limitimposed by the Falcon API, which is used to retrieve the detections from the CrowdStrike Cloud1. If there are more than 1000 detections per day for a single AID, only the first 1000 will be shown1.
NEW QUESTION # 41
When examining a raw DNS request event, you see a field called ContextProcessld_decimal. What is the purpose of that field?
- A. It contains the TargetProcessld_decimal value for other related events
- B. It contains the TargetProcessld_decimal value for the process that made the DNS request
- C. It contains the ContextProcessld_decimal value for the parent process that made the DNS request
- D. It contains an internal value not useful for an investigation
Answer: B
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the ContextProcessld_decimal field contains the decimal value of the process ID of the process that generated the event1. This field can be used to trace the process lineage and identify malicious or suspicious activities1. For a DNS request event, this field indicates which process made the DNS request1.
NEW QUESTION # 42
Sensor Visibility Exclusion patterns are written in which syntax?
- A. SPL(Splunk)
- B. Kleene Star Syntax
- C. RegEx
- D. Glob Syntax
Answer: D
Explanation:
Explanation
According to the [CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide], Sensor Visibility Exclusions allow you to exclude files or directories from being monitored by the sensor. This can reduce the amount of data sent to the CrowdStrike Cloud and improve performance. Sensor Visibility Exclusion patterns are written in Glob Syntax, which is a simple pattern matching syntax that supports wildcards, such as *, ?, and . For example, you can use *.exe to exclude all files with .exe extension.
NEW QUESTION # 43
Within the MITRE-Based Falcon Detections Framework, what is the correct way to interpret Keep Access > Persistence > Create Account?
- A. adversary is trying to keep access through persistence using application skimming
- B. An adversary is trying to keep access through persistence by creating an account
- C. An adversary is trying to keep access through persistence using browser extensions
- D. An adversary is trying to keep access through persistence using external remote services
Answer: B
Explanation:
Explanation
According to the [CrowdStrike website], the MITRE-Based Falcon Detections Framework is a way of categorizing and describing detections based on the MITRE ATT&CK knowledge base ofadversary behaviors and techniques. The framework uses three levels of granularity: category, tactic, and technique. The category is the highest level and represents the main objective of an adversary, such as initial access, execution, credential access, etc. The tactic is the second level and represents the sub-objective of an adversary within a category, such as persistence, privilege escalation, defense evasion, etc. The technique is the lowest level and represents the specific way an adversary can achieve a tactic, such as create account, modify registry, obfuscated files or information, etc. Therefore, the correct way to interpret Keep Access > Persistence > Create Account is that an adversary is trying to keep access through persistence by creating an account.
NEW QUESTION # 44
A list of managed and unmanaged neighbors for an endpoint can be found:
- A. by reviewing "Groups" in Host Management under the Hosts page
- B. by using Hosts page in the Investigate tool
- C. under "Audit" by running Sensor Visibility Exclusions Audit
- D. only by searching event data using Event Search
Answer: B
Explanation:
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, you can use the Hosts page in the Investigate tool to view information about your endpoints, such as hostname, IP address, OS, sensor version, etc2. You can also see a list of managed and unmanaged neighbors for each endpoint, which are other devices that have communicated with that endpoint over the network2. This can help you identify potential threats or vulnerabilities in your network2.
NEW QUESTION # 45
Which Executive Summary dashboard item indicates sensors running with unsupported versions?
- A. Active Sensors
- B. Sensors in RFM
- C. Inactive Sensors
- D. Detections by Severity
Answer: B
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Executive Summary dashboard provides an overview of your sensor health and activity1. It includes various items, such as Active Sensors, Inactive Sensors, Detections by Severity, etc1. The item that indicates sensors running with unsupported versions is Sensors in RFM (Reduced Functionality Mode)1. RFM is a state where a sensor has limited functionality due to various reasons, such as license expiration, network issues, tampering attempts, or unsupported versions1. You can see the number and percentage of sensors in RFM and the reasons why they are in RFM1.
NEW QUESTION # 46
When analyzing an executable with a global prevalence of common; but you do not know what the executable is. what is the best course of action?
- A. From detection, use API manager to create a custom blocklist
- B. From detection, click the VT Hash button to pivot to VirusTotal to investigate further
- C. Do nothing, as this file is common and well known
- D. From detection, submit to FalconX for deep dive analysis
Answer: B
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, global prevalence is a field that indicates how frequently the hash of a file is seen across all CrowdStrike customer environments1. A global prevalence of common means that the file is widely distributed and likely benign1. However, if you do not know what the executable is, you may want to investigate it further to confirm its legitimacy and functionality1. One way to do that is to click the VT Hash button from the detection, which will pivot you to VirusTotal, a service that analyzes files and URLs for viruses, malware, and other threats1. You can then see more information about the file, such as its name, size, type, signatures, detections, comments, etc1.
NEW QUESTION # 47
How long are quarantined files stored in the CrowdStrike Cloud?
- A. 90 Days
- B. 45 Days
- C. Quarantined files are not deleted
- D. Days
Answer: A
Explanation:
Explanation
According to the [CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide], when you quarantine a file from a host using IOC Management or Real Time Response (RTR), you are moving it from its original location to a secure location on the host where it cannot be executed. The file is also encrypted and renamed with a random string of characters. A copy of the file is also uploaded to the CrowdStrike Cloud for further analysis. Quarantined files are stored in the CrowdStrike Cloud for 90 days before they are deleted.
NEW QUESTION # 48
The Process Activity View provides a rows-and-columns style view of the events generated in a detection.
Why might this be helpful?
- A. The Process Activity View only creates a summary of Dynamic Link Libraries (DLLs) loaded by a process
- B. The Process Activity View will show the Detection time of the earliest recorded activity which might indicate first affected machine
- C. The Process Activity View creates a count of event types only, which can be useful when scoping the event
- D. The Process Activity View creates a consolidated view of all detection events for that process that can be exported for further analysis
Answer: D
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Process Activity View allows you to view all events generated by a process involved in a detection in a rows-and-columns style view1. This can be helpful because it creates a consolidated view of all detection events for that process that can be exported for further analysis1. You can also sort, filter, and pivot on the events by various fields, such as event type, timestamp, file name, registry key, network destination, etc1.
NEW QUESTION # 49
When examining raw event data, what is the purpose of the field called ParentProcessld_decimal?
- A. It contains the Sensorld_decimal value for related events
- B. It contains the TargetProcessld_decimal value of the child process
- C. It contains an internal value not useful for an investigation
- D. It contains the TargetProcessld_decimal of the parent process
Answer: D
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the ParentProcessld_decimal field contains the decimal value of the process ID of the parent process that spawned or injected into the target process1. This field can be used to trace the process lineage and identify malicious or suspicious activities1.
NEW QUESTION # 50
How long does detection data remain in the CrowdStrike Cloud before purging begins?
- A. 90 Days
- B. 45 Days
- C. 30 Days
- D. 14 Days
Answer: A
Explanation:
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, detection data is stored in the CrowdStrike Cloud for 90 days before purging begins2. This means that you can access and view detections from the past 90 days using the Falcon platform or API2. If you want to retain detection data for longer than 90 days, you can use FDR to replicate it to your own storage system2.
NEW QUESTION # 51
When you configure and apply an IOA exclusion, what impact does it have on the host and what you see in the console?
- A. The process specified is not sent to the Falcon Sandbox for analysis
- B. The sensor will stop sending events from the process specified in the regex pattern
- C. The associated IOA will still generate a detection but the associated process would have been allowed to run
- D. The associated detection will be suppressed and the associated process would have been allowed to run
Answer: D
Explanation:
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, IOA exclusions allow you to exclude files or directories from being detected or blocked by CrowdStrike's indicators of attack (IOAs), which are behavioral rules that identify malicious activities1. This can reduce false positives and improve performance1. When you configure and apply an IOA exclusion, the impact is that the associated detection will be suppressed and theassociated process would have been allowed to run1. This means that you will not see any alerts or events related to that IOA in the console1.
NEW QUESTION # 52
Which of the following is an example of a MITRE ATT&CK tactic?
- A. Defense Evasion
- B. Phishing
- C. Eternal Blue
- D. Emotet
Answer: A
Explanation:
Explanation
According to the [MITRE ATT&CK website], MITRE ATT&CK is a knowledge base of adversary behaviors and techniques based on real-world observations. The knowledge base is organized into tactics and techniques, where tactics are the high-level goals of an adversary, such as initial access, persistence, lateral movement, etc., and techniques are the specific ways an adversary can achieve those goals, such as phishing, credential dumping, remote file copy, etc. Defense Evasion is one of the tactics defined by MITRE ATT&CK, which covers actions that adversaries take to avoid detection or prevent security controls from blocking their activities. Eternal Blue, Emotet, and Phishing are examples of techniques, not tactics.
NEW QUESTION # 53
What is an advantage of using the IP Search tool?
- A. IP searches provide host, process, and organizational unit data without the need to write a query
- B. IP searches allow for multiple comma separated IPv6 addresses as input
- C. IP searches provide manufacture and timezone data that can not be accessed anywhere else
- D. IP searches offer shortcuts to launch response actions and network containment on target hosts
Answer: A
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the IP Search tool allows you to search for an IP address and view a summary of information from Falcon events that contain that IP address1. The summary includes the hostname, sensor ID, OS, country, city, ISP, ASN, geolocation, process name, command line, and organizational unit of the host that communicated with that IP address1. This is an advantage of using the IP Search tool because it provides host, process, and organizational unit data without the need to write a query1.
NEW QUESTION # 54
Which of the following is NOT a valid event type?
- A. ProcessRollup2
- B. EndofProcess
- C. DnsRequest
- D. StartofProcess
Answer: B
Explanation:
Explanation
According to the [CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+], event types are categories of events that are generated by the sensor for various activities, such as process executions, file writes, registry modifications, network connections, etc. There are many valid event types, such as StartOfProcess, ProcessRollup2, DnsRequest, etc. However, EndOfProcess is not a valid event type, as there is no such event that records the end of a process.
NEW QUESTION # 55
What action is used when you want to save a prevention hash for later use?
- A. No Action
- B. Never Block
- C. Always Allow
- D. Always Block
Answer: D
Explanation:
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, the Always Block action allows you to block a file from executing on any host in your organization based on its hash value2. This action can be used to prevent known malicious files from running on your endpoints2.
NEW QUESTION # 56
......
Get 100% Real Free CrowdStrike CCFR CCFR-201 Sample Questions: https://pass4sure.prep4cram.com/CCFR-201-exam-cram.html
