CrowdStrike CCFR-201 Online Practice Questions and Exam Preparation

CrowdStrike CCFR-201 Online Questions & Answers

• Question 1:

  You can jump to a Process Timeline from many views, like a Hash Search, by clicking which of the following?

  A. ProcessTimeline Link
  B. PID
  C. UTCtime
  D. Process ID or Parent Process ID
  D. Process ID or Parent Process ID

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Process Timeline tool allows you to view all cloudable events associated with a given process, such as process creation, network connections, file writes, registry modifications, etc1. The tool requires two parameters: aid (agent ID) and TargetProcessId_decimal (the decimal value of the process ID)1. You can jump to a Process Timeline from many views, such as Hash Search, Host Timeline, Event Search, etc., by clicking on either the Process ID or Parent Process ID fields in those views1. This will automatically populate the aid and TargetProcessId_decimal parameters for the Process Timeline tool1.

• Question 2:

  What types of events are returned by a Process Timeline?

  A. Only detection events
  B. All cloudable events
  C. Only process events
  D. Only network events
  B. All cloudable events

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Process Timeline search returns all cloudable events associated with a given process, such as process creation, network connections, file writes, registry modifications, etc1. This allows you to see a comprehensive view of what a process was doing on a host1.

• Question 3:

  How long does detection data remain in the CrowdStrike Cloud before purging begins?

  A. 90 Days
  B. 45 Days
  C. 30 Days
  D. 14 Days
  A. 90 Days

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon?Data Replicator (FDR) Add-on for Splunk Guide, detection data is stored in the CrowdStrike Cloud for 90 days before purging begins2. This means that you can access and view detections from the past 90 days using the Falcon platform or API2. If you want to retain detection data for longer than 90 days, you can use FDR to replicate it to your own storage system2.

• Question 4:

  Which is TRUE regarding a file released from quarantine?

  A. No executions are allowed for 14 days after release
  B. It is allowed to execute on all hosts
  C. It is deleted
  D. It will not generate future machine learning detections on the associated host
  B. It is allowed to execute on all hosts

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon?Data Replicator (FDR) Add-on for Splunk Guide, when you release a file from quarantine, you are restoring it to its original location and allowing it to execute on any host in your organization2. This action also removes the file from the quarantine list and deletes it from the CrowdStrike Cloud2.

• Question 5:

  After pivoting to an event search from a detection, you locate the ProcessRollup2 event. Which two field values are you required to obtain to perform a Process Timeline search so you can determine what the process was doing?

  A. SHA256 and TargetProcessld_decimal
  B. SHA256 and ParentProcessld_decimal
  C. aid and ParentProcessld_decimal
  D. aid and TargetProcessld_decimal
  D. aid and TargetProcessld_decimal

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Process Timeline search requires two parameters: aid (agent ID) and TargetProcessId_decimal (the decimal value of the process ID). These fields can be obtained from the ProcessRollup2 event, which contains information about processes that have executed on a host1.

• Question 6:

  What is the difference between a Host Search and a Host Timeline?

  A. Results from a Host Search return information in an organized view by type, while a Host Timeline returns a view of all events recorded by the sensor
  B. A Host Timeline only includes process execution events and user account activity
  C. Results from a Host Timeline include process executions and related events organized by data type. A Host Search returns a temporal view of all events for the given host
  D. There is no difference - Host Search and Host Timeline are different names for the same search page
  A. Results from a Host Search return information in an organized view by type, while a Host Timeline returns a view of all events recorded by the sensor

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Host Search allows you to search for hosts based on various criteria, such as hostname, IP address, OS, etc1. The results are displayed in an organized view by type, such as detections, incidents, processes, network connections, etc1. The Host Timeline allows you to view all events recorded by the sensor for a given host in a chronological order1. The events include process executions, file writes, registry modifications, network connections, user logins, etc1.

• Question 7:

  Which of the following is NOT a filter available on the Detections page?

  A. Severity
  B. CrowdScore
  C. Time
  D. Triggering File
  D. Triggering File

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon?Data Replicator (FDR) Add-on for Splunk Guide, the Detections page allows you to view and manage detections generated by the CrowdStrike Falcon platform2. You can use various filters to narrow down the detections based on criteria such as severity, CrowdScore, time, tactic, technique, etc2. However, there is no filter for triggering file, which is the file that caused the detection2.

• Question 8:

  A list of managed and unmanaged neighbors for an endpoint can be found:

  A. by using Hosts page in the Investigate tool
  B. by reviewing "Groups" in Host Management under the Hosts page
  C. under "Audit" by running Sensor Visibility Exclusions Audit
  D. only by searching event data using Event Search
  A. by using Hosts page in the Investigate tool

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon?Data Replicator (FDR) Add-on for Splunk Guide, you can use the Hosts page in the Investigate tool to view information about your endpoints, such as hostname, IP address, OS, sensor version, etc2. You can also see a list of managed and unmanaged neighbors for each endpoint, which are other devices that have communicated with that endpoint over the network2. This can help you identify potential threats or vulnerabilities in your network2.

• Question 9:

  What do IOA exclusions help you achieve?

  A. Reduce false positives based on Next-Gen Antivirus settings in the Prevention Policy
  B. Reduce false positives of behavioral detections from IOA based detections only
  C. Reduce false positives of behavioral detections from IOA based detections based on a file hash
  D. Reduce false positives of behavioral detections from Custom IOA and OverWatch detections only
  B. Reduce false positives of behavioral detections from IOA based detections only

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon?Data Replicator (FDR) Add-on for Splunk Guide, IOA exclusions allow you to exclude files or directories from being detected or blocked by CrowdStrike's indicators of attack (IOAs), which are behavioral rules that identify malicious activities2. This can reduce false positives and improve performance2. IOA exclusions only apply to IOA based detections, not other types of detections such as machine learning, custom IOA, or OverWatch2.

• Question 10:

  Which of the following is an example of a MITRE ATTandCK tactic?

  A. Eternal Blue
  B. Defense Evasion
  C. Emotet
  D. Phishing
  B. Defense Evasion

  ---

  Explanation/Reference:

  According to the [MITRE ATTandCK website], MITRE ATTandCK is a knowledge base of adversary behaviors and techniques based on real-world observations. The knowledge base is organized into tactics and techniques, where tactics are the high-level goals of an adversary, such as initial access, persistence, lateral movement, etc., and techniques are the specific ways an adversary can achieve those goals, such as phishing, credential dumping, remote file copy, etc. Defense Evasion is one of the tactics defined by MITRE ATTandCK, which covers actions that adversaries take to avoid detection or prevent security controls from blocking their activities. Eternal Blue, Emotet, and Phishing are examples of techniques, not tactics.