CrowdStrike CCFR-201 Online Practice Questions and Exam Preparation

CrowdStrike CCFR-201 Online Questions & Answers

• Question 11:

  What happens when you create a Sensor Visibility Exclusion for a trusted file path?

  A. It excludes host information from Detections and Incidents generated within that file path location
  B. It prevents file uploads to the CrowdStrike cloud from that file path
  C. It excludes sensor monitoring and event collection for the trusted file path
  D. It disables detection generation from that path, however the sensor can still perform prevention actions
  C. It excludes sensor monitoring and event collection for the trusted file path

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon?Data Replicator (FDR) Add-on for Splunk Guide, Sensor Visibility Exclusions allow you to exclude certain files or directories from being monitored by the CrowdStrike sensor, which can reduce noise and improve performance2. This means that no events will be collected or sent to the CrowdStrike Cloud for those files or directories2.

• Question 12:

  Which of the following is returned from the IP Search tool?

  A. IP Summary information from Falcon events containing the given IP
  B. Threat Graph Data for the given IP from Falcon sensors
  C. Unmanaged host data from system ARP tables for the given IPD.IP Detection Summary information for detection events containing the given IP
  A. IP Summary information from Falcon events containing the given IP

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the IP Search tool allows you to search for an IP address and view a summary of information from Falcon events that contain that IP address1. The summary includes the hostname, sensor ID, OS, country, city, ISP, ASN, and geolocation of the host that communicated with that IP address1.

• Question 13:

  The primary purpose for running a Hash Search is to:

  A. determine any network connections
  B. review the processes involved with a detection
  C. determine the origin of the detection
  D. review information surrounding a hash's related activity
  D. review information surrounding a hash's related activity

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Hash Search tool allows you to search for one or more SHA256 hashes and view a summary of information from Falcon events that contain those hashes1. The summary includes the hostname, sensor ID, OS, country, city, ISP, ASN, geolocation, process name, command line, and organizational unit of the host that loaded or executed those hashes1. You can also see a count of detections and incidents related to those hashes1. The primary purpose for running a Hash Search is to review information surrounding a hash's related activity, such as which hosts and processes were involved, where they were located, and whether they triggered any alerts1.

• Question 14:

  In the "Full Detection Details", which view will provide an exportable text listing of events like DNS requests. Registry Operations, and Network Operations?

  A. Thedata is unable to be exported
  B. View as Process Tree
  C. View as Process Timeline
  D. View as Process Activity
  D. View as Process Activity

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Full Detection Details tool allows you to view detailed information about a detection, such as detection ID, severity, tactic, technique, description, etc1. You can also view the events generated by the processes involved in the detection in different ways, such as process tree, process timeline, or process activity1. The process activity view provides a rows-andcolumns style view of the events, such as DNS requests, registry operations, network operations, etc1. You can also export this view to a CSV file for further analysis1.

• Question 15:

  The Process Activity View provides a rows-and-columns style view of the events generated in a detection. Why might this be helpful?

  A. The Process Activity View creates a consolidated view of all detection events for that process that can be exported for further analysis
  B. The Process Activity View will show the Detection time of the earliest recorded activity which might indicate first affected machine
  C. The Process Activity View only creates a summary of Dynamic Link Libraries (DLLs) loaded by a process
  D. The Process Activity View creates a count of event types only, which can be useful when scoping the event
  A. The Process Activity View creates a consolidated view of all detection events for that process that can be exported for further analysis

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Process Activity View allows you to view all events generated by a process involved in a detection in a rows-and-columns style view1. This can be helpful because it creates a consolidated view of all detection events for that process that can be exported for further analysis1. You can also sort, filter, and pivot on the events by various fields, such as event type, timestamp, file name, registry key, network destination, etc1.

• Question 16:

  When you configure and apply an IOA exclusion, what impact does it have on the host and what you see in the console?

  A. The process specified is not sent to the Falcon Sandbox for analysis
  B. The associated detection will be suppressed and the associated process would have been allowed to run
  C. The sensor will stop sending events from the process specified in the regex pattern
  D. The associated IOA will still generate a detection but the associated process would have been allowed to run
  B. The associated detection will be suppressed and the associated process would have been allowed to run

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon?Data Replicator (FDR) Add-on for Splunk Guide, IOA exclusions allow you to exclude files or directories from being detected or blocked by CrowdStrike's indicators of attack (IOAs), which are behavioral rules that identify malicious activities1. This can reduce false positives and improve performance1. When you configure and apply an IOA exclusion, the impact is that the associated detection will be suppressed and theassociated process would have been allowed to run1. This means that you will not see any alerts or events related to that IOA in the console1.

• Question 17:

  What information is contained within a Process Timeline?

  A. All cloudable process-related events within a given timeframe
  B. All cloudable events for a specific host
  C. Only detection process-related events within a given timeframe
  D. A view of activities on Mac or Linux hosts
  A. All cloudable process-related events within a given timeframe

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Process Timeline tool allows you to view all cloudable events associated with a given process, such as process creation, network connections, file writes, registry modifications, etc1. You can specify a timeframe to limit the events to a certain period1. The tool works for any host platform, not just Mac or Linux1.

• Question 18:

  When examining a raw DNS request event, you see a field called ContextProcessld_decimal. What is the purpose of that field?

  A. It contains the TargetProcessld_decimal value for other related events
  B. It contains an internal value not useful for an investigation
  C. It contains the ContextProcessld_decimal value for the parent process that made the DNS request
  D. It contains the TargetProcessld_decimal value for the process that made the DNS request
  D. It contains the TargetProcessld_decimal value for the process that made the DNS request

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the ContextProcessld_decimal field contains the decimal value of the process ID of the process that generated the event1. This field can be used to trace the process lineage and identify malicious or suspicious activities1. For a DNS request event, this field indicates which process made the DNS request1.

• Question 19:

  You found a list of SHA256 hashes in an intelligence report and search for them using the Hash Execution Search. What can be determined from the results?

  A. Identifies a detailed list of all process executions for the specified hashes
  B. Identifies hosts that loaded or executed the specified hashes
  C. Identifies users associated with the specified hashes
  D. Identifies detections related to the specified hashes
  B. Identifies hosts that loaded or executed the specified hashes

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Hash Execution Search tool allows you to search for one or more SHA256 hashes and view a summary of information from Falcon events that contain those hashes1. The summary includes the hostname, sensor ID, OS, country, city, ISP, ASN, and geolocation of the host that loaded or executed those hashes1. You can also see a count of detections and incidents related to those hashes1.

• Question 20:

  What happens when a quarantined file is released?

  A. It is moved into theC:\CrowdStrike\Quarantine\Releasedfolder on the host
  B. It is allowed to execute on the host
  C. It is deleted
  D. It is allowed to execute on all hosts
  D. It is allowed to execute on all hosts

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon?Data Replicator (FDR) Add-on for Splunk Guide, when you release a file from quarantine, you are restoring it to its original location and allowing it to execute on any host in your organization1. This action also removes the file from the quarantine list and deletes it from the CrowdStrike Cloud1.