CrowdStrike CCFR-201 Online Practice Questions and Exam Preparation

CrowdStrike CCFR-201 Online Questions & Answers

• Question 21:

  How long are quarantined files stored in the CrowdStrike Cloud?

  A. 45 Days
  B. 90 Days
  C. Days
  D. Quarantined files are not deleted
  B. 90 Days

  ---

  Explanation/Reference:

  According to the [CrowdStrike Falcon?Data Replicator (FDR) Add-on for Splunk Guide], when you quarantine a file from a host using IOC Management or Real Time Response (RTR), you are moving it from its original location to a secure location on the host where it cannot be executed. The file is also encrypted and renamed with a random string of characters. A copy of the file is also uploaded to the CrowdStrike Cloud for further analysis. Quarantined files are stored in the CrowdStrike Cloud for 90 days before they are deleted.

• Question 22:

  When analyzing an executable with a global prevalence of common; but you do not know what the executable is. what is the best course of action?

  A. Do nothing, as this file is common and well known
  B. From detection, click the VT Hash button to pivot to VirusTotal to investigate further
  C. From detection, use API manager to create a custom blocklist
  D. From detection, submit to FalconX for deep dive analysis
  B. From detection, click the VT Hash button to pivot to VirusTotal to investigate further

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, global prevalence is a field that indicates how frequently the hash of a file is seen across all CrowdStrike customer environments1. A global prevalence of common means that the file is widely distributed and likely benign1. However, if you do not know what the executable is, you may want to investigate it further to confirm its legitimacy and functionality1. One way to do that is to click the VT Hash button from the detection, which will pivot you to VirusTotal, a service that analyzes files and URLs for viruses, malware, and other threats1. You can then see more information about the file, such as its name, size, type, signatures, detections, comments, etc1.

• Question 23:

  After running an Event Search, you can select many Event Actions depending on your results. Which of the following is NOT an option for any Event Action?

  A. Draw Process Explorer
  B. Show a +/- 10-minute window of events
  C. Show a Process Timeline for the responsible process
  D. Show Associated Event Data (from TargetProcessld_decimal or ContextProcessld_decimal)
  A. Draw Process Explorer
  C. Show a Process Timeline for the responsible process
  D. Show Associated Event Data (from TargetProcessld_decimal or ContextProcessld_decimal)

• Question 24:

  Which statement is TRUE regarding the "Bulk Domains" search?

  A. It will show a list of computers and process that performed a lookup of any of the domains in your search
  B. The "Bulk Domains" search will allow you to blocklist your queried domains
  C. The "Bulk Domains" search will show IP address and port information for any associated connectionsD.You should only pivot to the "Bulk Domains" search tool after completing an investigation
  A. It will show a list of computers and process that performed a lookup of any of the domains in your search

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Bulk Domain Search tool allows you to search for one or more domains and view a summary of information from Falcon events that contain those domains2. The summary includes the hostname, sensor ID, OS, country, city, ISP, ASN, geolocation, process name, command line, and organizational unit of the host that performed a lookup of any of the domains in your search2. This can help you identify potential threats or vulnerabilities in your network2.

• Question 25:

  What does the Full Detection Details option provide?

  A. It provides a visualization of program ancestry via the Process Tree View
  B. It provides a visualization of program ancestry via the Process Activity View
  C. It provides detailed list of detection events via the Process Table View
  D. It provides a detailed list of detection events via the Process Tree View
  A. It provides a visualization of program ancestry via the Process Tree View

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Full Detection Details option allows you to view detailed information about a detection, such as detection ID, severity, tactic, technique, description, etc1. You can also view the events generated by the processes involved in the detection in different ways, such as process tree, process timeline, or process activity1. The process tree view provides a visualization of program ancestry, which shows the parent-child and sibling relationships among the processes1. You can also see the event types and timestamps for each process1.

• Question 26:

  What action is used when you want to save a prevention hash for later use?

  A. Always Block
  B. Never Block
  C. Always Allow
  D. No Action
  A. Always Block

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon?Data Replicator (FDR) Add-on for Splunk Guide, the Always Block action allows you to block a file from executing on any host in your organization based on its hash value2. This action can be used to prevent known malicious files from running on your endpoints2.

• Question 27:

  What are Event Actions?

  A. Automated searches that can be used to pivot between related events and searches
  B. Pivotable hyperlinks available in a Host Search
  C. Custom event data queries bookmarked by the currently signed in Falcon user
  D. Raw Falcon event data
  A. Automated searches that can be used to pivot between related events and searches

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, Event Actions are automated searches that can be used to pivot between related events and searches1. They are available in various tools, such as Event Search, Process Timeline, Host Timeline, etc1. You can select one or more events and perform various actions, such as show a process timeline, show a host timeline, show associated event data, show a +/- 10minute window of events, etc1. These actions can help you investigate and analyze events more efficiently and effectively1.

• Question 28:

  What does pivoting to an Event Search from a detection do?

  A. It gives you the ability to search for similar events on other endpoints quickly
  B. It takes you to the raw Insight event data and provides you with a number of Event Actions
  C. It takes you to a Process Timeline for that detection so you can see all related events
  D. It allows you to input an event type, such as DNS Request or ASEP write, and search for those events within the detection
  B. It takes you to the raw Insight event data and provides you with a number of Event Actions

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, pivoting to an Event Search from a detection takes you to the raw Insight event data and provides you with a number of Event Actions1. Insight events are low-level events that are generated by the sensor for various activities, such as process executions, file writes, registry modifications, network connections, etc1. You can view these events in a table format and use various filters and fields to narrow down the results1. You can also select one or more events and perform various actions, such as show a process timeline, show a host timeline, show associated event data, show a +/- 10- minute window of events, etc1. These actions can help you investigate and analyze events more efficiently and effectively1.

• Question 29:

  From the Detections page, how can you view 'in-progress' detections assigned to Falcon Analyst Alex?

  A. Filter on'Analyst: Alex'
  B. Alex does not have the correct role permissions as a Falcon Analyst to be assigned detections
  C. Filter on 'Hostname: Alex' and 'Status: In-Progress'
  D. Filter on 'Status: In-Progress' and 'Assigned-to: Alex*
  D. Filter on 'Status: In-Progress' and 'Assigned-to: Alex*

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon?Data Replicator (FDR) Add-on for Splunk Guide, the Detections page allows you to view and manage detections generated by the CrowdStrike Falcon platform2. You can use various filters to narrow down the detections based on criteria such asstatus, severity, tactic, technique, etc2. To view `in- progress' detections assigned to Falcon Analyst Alex, you can filter on `Status: In-Progress' and 'Assigned-to: Alex*'2. The asterisk (*) is a wildcard that matches any characters after Alex2.

• Question 30:

  What is an advantage of using a Process Timeline?

  A. Process related events can be filtered to display specific event types
  B. Suspicious processes are color-coded based on their frequency and legitimacy over time
  C. Processes responsible for spikes in CPU performance are displayed overtime
  D. A visual representation of Parent-Child and Sibling process relationships is provided
  A. Process related events can be filtered to display specific event types

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Process Timeline tool allows you to view all cloudable events associated with a given process, such as process creation, network connections, file writes, registry modifications, etc2. You can also filter the events by various criteria, such as event type, timestamp range, file name, registry key, network destination, etc2. This is an advantage of using the Process Timeline tool because it allows you to focus on specific events that are relevant to your investigation2.