2023 Realistic CCFR-201 Dumps Latest CrowdStrike Practice Tests Dumps
CCFR-201 Dumps PDF - CCFR-201 Real Exam Questions Answers
NEW QUESTION # 32
The primary purpose for running a Hash Search is to:
- A. determine any network connections
- B. determine the origin of the detection
- C. review information surrounding a hash's related activity
- D. review the processes involved with a detection
Answer: C
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Hash Search tool allows you to search for one or more SHA256 hashes and view a summary of information from Falcon events that contain those hashes1. The summary includes the hostname, sensor ID, OS, country, city, ISP, ASN, geolocation, process name, command line, and organizational unit of the host that loaded or executed those hashes1. You can also see a count of detections and incidents related to those hashes1. The primary purpose for running a Hash Search is to review information surrounding a hash's related activity, such as which hosts and processes were involved, where they were located, and whether they triggered any alerts1.
NEW QUESTION # 33
What is the difference between a Host Search and a Host Timeline?
- A. Results from a Host Search return information in an organized view by type, while a Host Timeline returns a view of all events recorded by the sensor
- B. There is no difference - Host Search and Host Timeline are different names for the same search page
- C. Results from a Host Timeline include process executions and related events organized by data type. A Host Search returns a temporal view of all events for the given host
- D. A Host Timeline only includes process execution events and user account activity
Answer: A
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Host Search allows you to search for hosts based on various criteria, such as hostname, IP address, OS, etc1. The results are displayed in an organized view by type, such as detections, incidents, processes, network connections, etc1. The Host Timeline allows you to view all events recorded by the sensor for a given host in a chronological order1. The events include process executions, file writes, registry modifications, network connections, user logins, etc1.
NEW QUESTION # 34
Which Executive Summary dashboard item indicates sensors running with unsupported versions?
- A. Detections by Severity
- B. Sensors in RFM
- C. Active Sensors
- D. Inactive Sensors
Answer: B
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Executive Summary dashboard provides an overview of your sensor health and activity1. It includes various items, such as Active Sensors, Inactive Sensors, Detections by Severity, etc1. The item that indicates sensors running with unsupported versions is Sensors in RFM (Reduced Functionality Mode)1. RFM is a state where a sensor has limited functionality due to various reasons, such as license expiration, network issues, tampering attempts, or unsupported versions1. You can see the number and percentage of sensors in RFM and the reasons why they are in RFM1.
NEW QUESTION # 35
Where can you find hosts that are in Reduced Functionality Mode?
- A. Event Search
- B. Executive Summary dashboard
- C. Host Search
- D. Installation Tokens
Answer: C
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, Reduced Functionality Mode (RFM) is a state where a host's sensor has limited functionality due to various reasons, such as license expiration, network issues, tampering attempts, etc1. You can find hosts that are in RFM by using the Host Search tool and filtering by Sensor Status = RFM1. You can also view details about why a host is in RFM by clicking on its hostname1.
NEW QUESTION # 36
In the "Full Detection Details", which view will provide an exportable text listing of events like DNS requests.
Registry Operations, and Network Operations?
- A. View as Process Tree
- B. View as Process Activity
- C. Thedata is unable to be exported
- D. View as Process Timeline
Answer: B
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Full Detection Details tool allows you to view detailed information about a detection, such as detection ID, severity, tactic, technique, description, etc1. You can also view the events generated by the processes involved in the detection in different ways, such as process tree, process timeline, or process activity1. The process activity view provides a rows-and-columns style view of the events, such as DNS requests, registry operations, network operations, etc1. You can also export this view to a CSV file for further analysis1.
NEW QUESTION # 37
Which of the following is returned from the IP Search tool?
- A. Unmanaged host data from system ARP tables for the given IPD.IP Detection Summary information for detection events containing the given IP
- B. Threat Graph Data for the given IP from Falcon sensors
- C. IP Summary information from Falcon events containing the given IP
Answer: C
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the IP Search tool allows you to search for an IP address and view a summary of information from Falcon events that contain that IP address1. The summary includes the hostname, sensor ID, OS, country, city, ISP, ASN, and geolocation of the host that communicated with that IP address1.
NEW QUESTION # 38
Where are quarantined files stored on Windows hosts?
- A. Windows\temp\Drivers\CrowdStrike\Quarantine
- B. Windows\Quarantine
- C. Windows\System32\Drivers\CrowdStrike\Quarantine
- D. Windows\System32\
Answer: C
Explanation:
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, when you quarantine a file from a host using IOC Management or Real Time Response (RTR), you are moving it from its original location to a secure location on the host where it cannot be executed2. The file is also encrypted and renamed with a random string of characters2. On Windows hosts, quarantined files are stored in C:\Windows\System32\Drivers\CrowdStrike\Quarantine folder2.
NEW QUESTION # 39
Sensor Visibility Exclusion patterns are written in which syntax?
- A. SPL(Splunk)
- B. RegEx
- C. Glob Syntax
- D. Kleene Star Syntax
Answer: C
Explanation:
Explanation
According to the [CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide], Sensor Visibility Exclusions allow you to exclude files or directories from being monitored by the sensor. This can reduce the amount of data sent to the CrowdStrike Cloud and improve performance. Sensor Visibility Exclusion patterns are written in Glob Syntax, which is a simple pattern matching syntax that supports wildcards, such as *, ?, and . For example, you can use *.exe to exclude all files with .exe extension.
NEW QUESTION # 40
What happens when you create a Sensor Visibility Exclusion for a trusted file path?
- A. It excludes sensor monitoring and event collection for the trusted file path
- B. It prevents file uploads to the CrowdStrike cloud from that file path
- C. It excludes host information from Detections and Incidents generated within that file path location
- D. It disables detection generation from that path, however the sensor can still perform prevention actions
Answer: A
Explanation:
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, Sensor Visibility Exclusions allow you to exclude certain files or directories from being monitored by the CrowdStrike sensor, which can reduce noise and improve performance2. This means that no events will be collected or sent to the CrowdStrike Cloud for those files or directories2.
NEW QUESTION # 41
What does pivoting to an Event Search from a detection do?
- A. It takes you to a Process Timeline for that detection so you can see all related events
- B. It takes you to the raw Insight event data and provides you with a number of Event Actions
- C. It gives you the ability to search for similar events on other endpoints quickly
- D. It allows you to input an event type, such as DNS Request or ASEP write, and search for those events within the detection
Answer: B
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, pivoting to an Event Search from a detection takes you to the raw Insight event data and provides you with a number of Event Actions1. Insight events are low-level events that are generated by the sensor for various activities, such as process executions, file writes, registry modifications, network connections, etc1. You can view these events in a table format and use various filters and fields to narrow down the results1. You can also select one or more events and perform various actions, such as show a process timeline, show a host timeline, show associated event data, show a +/- 10-minute window of events, etc1. These actions can help you investigate and analyze events more efficiently and effectively1.
NEW QUESTION # 42
What does the Full Detection Details option provide?
- A. It provides a visualization of program ancestry via the Process Tree View
- B. It provides a detailed list of detection events via the Process Tree View
- C. It provides detailed list of detection events via the Process Table View
- D. It provides a visualization of program ancestry via the Process Activity View
Answer: A
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Full Detection Details option allows you to view detailed information about a detection, such as detection ID, severity, tactic, technique, description, etc1. You can also view the events generated by the processes involved in the detection in different ways, such as process tree, process timeline, or process activity1. The process tree view provides a visualization of program ancestry, which shows the parent-child and sibling relationships among the processes1. You can also see the event types and timestamps for each process1.
NEW QUESTION # 43
What happens when a hash is set to Always Block through IOC Management?
- A. Execution is prevented on all hosts by default
- B. The hash is submitted for approval to be blocked from execution once confirmed by Falcon specialists
- C. Execution is prevented on selected host groups
- D. Execution is prevented and detection alerts are suppressed
Answer: A
Explanation:
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, IOC Management allows you to manage indicators of compromise (IOCs), which are artifacts such as hashes, IP addresses, or domains that are associated with malicious activities2. You can set different actions for IOCs, such as Allow, No Action, or Always Block2. When you set a hash to Always Block through IOC Management, you are preventing that file from executing on any host in your organization by default2. This action also generates a detection alert when the file is blocked2.
NEW QUESTION # 44
What is an advantage of using a Process Timeline?
- A. A visual representation of Parent-Child and Sibling process relationships is provided
- B. Suspicious processes are color-coded based on their frequency and legitimacy over time
- C. Process related events can be filtered to display specific event types
- D. Processes responsible for spikes in CPU performance are displayed overtime
Answer: C
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Process Timeline tool allows you to view all cloudable events associated with a given process, such as process creation, network connections, file writes, registry modifications, etc2. You can also filter the events by various criteria, such as event type, timestamp range, file name, registry key, network destination, etc2. This is an advantage of using the Process Timeline tool because it allows you to focus on specific events that are relevant to your investigation2.
NEW QUESTION # 45
From a detection, what is the fastest way to see children and sibling process information?
- A. Select the Process Timeline feature, enter the AID. Target Process ID, and Parent Process ID
- B. Select Full Detection Details from the detection
- C. Select the Event Search option. Then from the Event Actions, select Show Associated Event Data (From TargetProcessld_decimal)
- D. Right-click the process and select "Follow Process Chain"
Answer: B
Explanation:
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, the Full Detection Details tool allows you to view detailed information about a detection, such as detection ID, severity, tactic, technique, description, etc1. You can also view the events generated by the processes involved in the detection in different ways, such as process tree, process timeline, or process activity1. The process tree view provides a graphical representation of the process hierarchy and activity1. You can see children and sibling processes information by expanding or collapsing nodes in the tree1.
NEW QUESTION # 46
When looking at the details of a detection, there are two fields called Global Prevalence and Local Prevalence.
Which answer best defines Local Prevalence?
- A. Local Prevalence tells you how common the hash of the triggering file is within your environment (CID)
- B. Local prevalence is the frequency with which the hash of the triggering file is seen across all CrowdStrike customer environments
- C. Local Prevalence is the Virus Total score for the hash of the triggering file
- D. Local prevalence is the frequency with which the hash of the triggering file is seen across the entire Internet
Answer: A
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, Global Prevalence and Local Prevalence are two fields that provide information about how common or rare a file is based on its hash value2. Global Prevalence tells you how frequently the hash of the triggering file is seen across all CrowdStrike customer environments2. Local Prevalence tells you how frequently the hash of the triggering file is seen within your environment (CID)2. These fields can help you assess the risk and impact of a detection2.
NEW QUESTION # 47
What is the difference between Managed and Unmanaged Neighbors in the Falcon console?
- A. A managed sensor has an active prevention policy
- B. A managed neighbor is currently network contained and an unmanaged neighbor is uncontained
- C. An unmanaged neighbor is in a segmented area of the network
- D. A managed neighbor has an installed and provisioned sensor
Answer: D
Explanation:
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, you can use the Hosts page in the Investigate tool to view information about your endpoints, such as hostname, IP address, OS, sensor version, etc2. You can also see a list of managed and unmanaged neighbors for each endpoint, which are other devices that have communicated with that endpoint over the network2. A managed neighbor is a device that has an installed and provisioned sensor that reports to the CrowdStrike Cloud2. An unmanaged neighbor is a device that does not have an installed or provisioned sensor2.
NEW QUESTION # 48
What do IOA exclusions help you achieve?
- A. Reduce false positives of behavioral detections from IOA based detections based on a file hash
- B. Reduce false positives of behavioral detections from Custom IOA and OverWatch detections only
- C. Reduce false positives of behavioral detections from IOA based detections only
- D. Reduce false positives based on Next-Gen Antivirus settings in the Prevention Policy
Answer: C
Explanation:
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, IOA exclusions allow you to exclude files or directories from being detected or blocked by CrowdStrike's indicators of attack (IOAs), which are behavioral rules that identify malicious activities2. This can reduce false positives and improve performance2. IOA exclusions only apply to IOA based detections, not other types of detections such as machine learning, custom IOA, or OverWatch2.
NEW QUESTION # 49
You are notified by a third-party that a program may have redirected traffic to a malicious domain. Which Falcon page will assist you in searching for any domain request information related to this notice?
- A. Discover
- B. Falcon X
- C. Spotlight
- D. Investigate
Answer: D
Explanation:
Explanation
According to the [CrowdStrike website], the Investigate page is where you can search for and analyze various types of data collected by the Falcon platform, such as events, hosts, processes, hashes, domains, IPs, etc1. You can use various tools, such as Event Search, Host Search, Process Timeline, Hash Search, Bulk Domain Search, etc., to perform different types of searches and view the results in different ways1. If you want to search for any domain request information related to a notice from a third-party, you can use the Investigate page to do so1. For example, you can use the Bulk Domain Search tool to search for the malicious domain and see which hosts and processes communicated with it1. You can also use the Event Search tool to search for DNSRequest events that contain the malicious domain and see more details about the query and response1.
NEW QUESTION # 50
What action is used when you want to save a prevention hash for later use?
- A. Never Block
- B. Always Block
- C. No Action
- D. Always Allow
Answer: B
Explanation:
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, the Always Block action allows you to block a file from executing on any host in your organization based on its hash value2. This action can be used to prevent known malicious files from running on your endpoints2.
NEW QUESTION # 51
How are processes on the same plane ordered (bottom 'VMTOOLSD.EXE' to top CMD.EXE')?
- A. Time started (Ascending, most recent on top)
- B. Process ID (Descending, highest on bottom)
- C. Process ID (Ascending, highest on top)
- D. Time started (Descending, most recent on bottom)
Answer: D
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the process tree view provides a visualization of program ancestry, which shows the parent-child and sibling relationships among the processes1. You can also see the event types and timestamps for each process1. The processes on the same plane are ordered by time started in descending order, meaning that the most recent process is at the bottom and the oldest process is at the top1. For example, in the image you sent me, CMD.EXE is the oldest process and VMTOOLSD.EXE is the most recent process on that plane1.
NEW QUESTION # 52
What are Event Actions?
- A. Automated searches that can be used to pivot between related events and searches
- B. Raw Falcon event data
- C. Custom event data queries bookmarked by the currently signed in Falcon user
- D. Pivotable hyperlinks available in a Host Search
Answer: A
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, Event Actions are automated searches that can be used to pivot between related events and searches1. They are available in various tools, such as Event Search, Process Timeline, Host Timeline, etc1. You can select one or more events and perform various actions, such as show a process timeline, show a host timeline, show associated event data, show a +/- 10-minute window of events, etc1. These actions can help you investigate and analyze events more efficiently and effectively1.
NEW QUESTION # 53
When examining a raw DNS request event, you see a field called ContextProcessld_decimal. What is the purpose of that field?
- A. It contains the ContextProcessld_decimal value for the parent process that made the DNS request
- B. It contains an internal value not useful for an investigation
- C. It contains the TargetProcessld_decimal value for the process that made the DNS request
- D. It contains the TargetProcessld_decimal value for other related events
Answer: C
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the ContextProcessld_decimal field contains the decimal value of the process ID of the process that generated the event1. This field can be used to trace the process lineage and identify malicious or suspicious activities1. For a DNS request event, this field indicates which process made the DNS request1.
NEW QUESTION # 54
Within the MITRE-Based Falcon Detections Framework, what is the correct way to interpret Keep Access > Persistence > Create Account?
- A. adversary is trying to keep access through persistence using application skimming
- B. An adversary is trying to keep access through persistence using external remote services
- C. An adversary is trying to keep access through persistence using browser extensions
- D. An adversary is trying to keep access through persistence by creating an account
Answer: D
Explanation:
Explanation
According to the [CrowdStrike website], the MITRE-Based Falcon Detections Framework is a way of categorizing and describing detections based on the MITRE ATT&CK knowledge base ofadversary behaviors and techniques. The framework uses three levels of granularity: category, tactic, and technique. The category is the highest level and represents the main objective of an adversary, such as initial access, execution, credential access, etc. The tactic is the second level and represents the sub-objective of an adversary within a category, such as persistence, privilege escalation, defense evasion, etc. The technique is the lowest level and represents the specific way an adversary can achieve a tactic, such as create account, modify registry, obfuscated files or information, etc. Therefore, the correct way to interpret Keep Access > Persistence > Create Account is that an adversary is trying to keep access through persistence by creating an account.
NEW QUESTION # 55
You are reviewing the raw data in an event search from a detection tree. You find a FileOpenlnfo event and want to find out if any other files were opened by the responsible process. Which two field values do you need from this event to perform a Process Timeline search?
- A. TargetProcessld_decimal and aid
- B. ParentProcessld_decimal and aid
- C. ContextProcessld_decimal and aid
- D. ResponsibleProcessld_decimal and aid
Answer: A
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Process Timeline tool allows you to view all cloudable events associated with a given process, such as process creation, network connections, file writes, registry modifications, etc2. The tool requires two parameters: aid (agent ID) and TargetProcessId_decimal (the decimal value of the process ID)2. These fields can be obtained from any event that involves the process, such as a FileOpenInfo event, which contains information about a file being opened by a process2.
NEW QUESTION # 56
After running an Event Search, you can select many Event Actions depending on your results. Which of the following is NOT an option for any Event Action?
- A. Show a Process Timeline for the responsible process
- B. Show a +/- 10-minute window of events
- C. Draw Process Explorer
- D. Show Associated Event Data (from TargetProcessld_decimal or ContextProcessld_decimal)
Answer: C
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Event Search tool allows you to search for events based on various criteria, such as event type, timestamp, hostname, IP address, etc1. You can also select one or more events and perform various actions, such as show a process timeline, show a host timeline, show associated event data, show a +/- 10-minute window of events, etc1. However, there is no option to draw a process explorer, which is a graphical representation of the process hierarchy and activity1.
NEW QUESTION # 57
......
CCFR-201 Premium Exam Engine pdf Download: https://www.exams4collection.com/CCFR-201-latest-braindumps.html
CCFR-201 Exam [2023] Dumps CrowdStrike PDF Questions: https://drive.google.com/open?id=1dxyNk81mw_SP5jJsMvFfuZFqTHFMG88S
