CCFR-201 practice test

1. Question 1 · 1

   Where can you find hosts that are in Reduced Functionality Mode?

   Choose one answer.

   • Event Search
   • Executive Summary dashboard
   • Host Search
   • Installation Tokens

2. Question 2 · 1

   What is an advantage of using a Process Timeline?

   Choose one answer.

   • Process related events can be filtered to display specific event types
   • Suspicious processes are color-coded based on their frequency and legitimacy over time
   • Processes responsible for spikes in CPU performance are displayed over time
   • A visual representation of Parent-Child and Sibling process relationships is provided

3. Question 3 · 1

   What action is used when you want to save a prevention hash for later use?

   Choose one answer.

   • Always Block
   • Never Block
   • Always Allow
   • No Action

4. Question 4 · 1

   You receive an email from a third-party vendor that one of their services is compromised, the vendor names a specific IP address that the compromised service was using. Where would you input this indicator to find any activity related to this IP address?

   Choose one answer.

   • IP Addresses
   • Remote or Network Logon Activity
   • Remote Access Graph
   • Hash Executions

5. Question 5 · 1

   You are reviewing the raw data in an event search from a detection tree. You find a FileOpenInfo event and want to find out if any other files were opened by the responsible process. Which two field values do you need from this event to perform a Process Timeline search?

   Choose one answer.

   • ParentProcessId_decimal and aid
   • ResponsibleProcessId_decimal and aid
   • ContextProcessId_decimal and aid
   • TargetProcessId_decimal and aid

6. Question 6 · 1

   How long are quarantined files stored in the CrowdStrike Cloud?

   Choose one answer.

   • 45 Days
   • 90 Days
   • 30 Days
   • Quarantined files are not deleted

7. Question 7 · 1

   You are notified by a third-party that a program may have redirected traffic to a malicious domain. Which Falcon page will assist you in searching for any domain request information related to this notice?

   Choose one answer.

   • Falcon X
   • Investigate
   • Discover
   • Spotlight

8. Question 8 · 1

   What information is contained within a Process Timeline?

   Choose one answer.

   • All cloudable process-related events within a given timeframe
   • All cloudable events for a specific host
   • Only detection process-related events within a given timeframe
   • A view of activities on Mac or Linux hosts

9. Question 9 · 1

   Sensor Visibility Exclusion patterns are written in which syntax?

   Choose one answer.

   • Glob Syntax
   • Kleene Star Syntax
   • RegEx
   • SPL (Splunk)

10. Question 10 · 1

    In the "Full Detection Details", which view will provide an exportable text listing of events like DNS requests. Registry Operations, and Network Operations?

    Choose one answer.

    • The data is unable to be exported
    • View as Process Tree
    • View as Process Timeline
    • View as Process Activity

11. Question 11 · 1

    What happens when a quarantined file is released?

    Choose one answer.

    • It is moved into the C:\CrowdStrike\Quarantine\Released folder on the host
    • It is allowed to execute on the host
    • It is deleted
    • It is allowed to execute on all hosts

12. Question 12 · 1

    When reviewing a Host Timeline, which of the following filters is available?

    Choose one answer.

    • Severity
    • Event Types
    • User Name
    • Detection ID

13. Question 13 · 1

    Which is TRUE regarding a file released from quarantine?

    Choose one answer.

    • No executions are allowed for 14 days after release
    • It is allowed to execute on all hosts
    • It is deleted
    • It will not generate future machine learning detections on the associated host

14. Question 14 · 1

    From the Detections page, how can you view 'in-progress' detections assigned to Falcon Analyst Alex?

    Choose one answer.

    • Filter on 'Analyst: Alex'
    • Alex does not have the correct role permissions as a Falcon Analyst to be assigned detections
    • Filter on 'Hostname: Alex' and 'Status: In-Progress'
    • Filter on 'Status: In-Progress' and 'Assigned-to: Alex'

15. Question 15 · 1

    The Bulk Domain Search tool contains Domain information along with which of the following?

    Choose one answer.

    • Process Information
    • Port Information
    • IP Lookup Information
    • Threat Actor Information

Paid access to all 60 questions

Each purchase applies to this certification. Prices are one-time payments, not monthly subscriptions.