CrowdStrike CCFR-201 Online Practice Questions and Exam Preparation

CrowdStrike CCFR-201 Online Questions & Answers

• Question 31:

  How does a DNSRequest event link to its responsible process?

  A. Via both its ContextProcessld__decimal and ParentProcessld_decimal fields
  B. Via its ParentProcessld_decimal field
  C. Via its ContextProcessld_decimal field
  D. Via its TargetProcessld_decimal field
  C. Via its ContextProcessld_decimal field

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, a DNSRequest event contains information about a DNS query made by a process2. The event has several fields, such as DomainName, QueryType, QueryResponseCode, etc2. The field that links a DNSRequest event to its responsible process is ContextProcessId_decimal, which contains the decimal value of the process ID of the process that generated the event2. You can use this field to trace the process lineage and identify malicious or suspicious activities2.

• Question 32:

  Which Executive Summary dashboard item indicates sensors running with unsupported versions?

  A. Detections by Severity
  B. Inactive Sensors
  C. Sensors in RFM
  D. Active Sensors
  C. Sensors in RFM

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Executive Summary dashboard provides an overview of your sensor health and activity1. It includes various items, such as Active Sensors, Inactive Sensors, Detections by Severity, etc1. The item that indicates sensors running with unsupported versions is Sensors in RFM (Reduced Functionality Mode)1. RFM is a state where a sensor has limited functionality due to various reasons, such as license expiration, network issues, tampering attempts, or unsupported versions1. You can see the number and percentage of sensors in RFM and the reasons why they are in RFM1.

• Question 33:

  When looking at the details of a detection, there are two fields called Global Prevalence and Local Prevalence. Which answer best defines Local Prevalence?

  A. Local prevalence is the frequency with which the hash of the triggering file is seen across the entire Internet
  B. Local Prevalence tells you how common the hash of the triggering file is within your environment (CID)
  C. Local Prevalence is the Virus Total score for the hash of the triggering file
  D. Local prevalence is the frequency with which the hash of the triggering file is seen across all CrowdStrike customer environments
  B. Local Prevalence tells you how common the hash of the triggering file is within your environment (CID)

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, Global Prevalence and Local Prevalence are two fields that provide information about how common or rare a file is based on its hash value2. Global Prevalence tells you how frequently the hash of the triggering file is seen across all CrowdStrike customer environments2. Local Prevalence tells you how frequently the hash of the triggering file is seen within your environment (CID)2. These fields can help you assess the risk and impact of a detection2.

• Question 34:

  You are notified by a third-party that a program may have redirected traffic to a malicious domain. Which Falcon page will assist you in searching for any domain request information related to this notice?

  A. Falcon X
  B. Investigate
  C. Discover
  D. Spotlight
  B. Investigate

  ---

  Explanation/Reference:

  According to the [CrowdStrike website], the Investigate page is where you can search for and analyze various types of data collected by the Falcon platform, such as events, hosts, processes, hashes, domains, IPs, etc1. You can use various tools, such as Event Search, Host Search, Process Timeline, Hash Search, Bulk Domain Search, etc., to perform different types of searches and view the results in different ways1. If you want to search for any domain request information related to a notice from a third-party, you can use the Investigate page to do so1. For example, you can use the Bulk Domain Search tool to search for the malicious domain and see which hosts and processes communicated with it1. You can also use the Event Search tool to search for DNSRequest events that contain the malicious domain and see more details about the query and response1.

• Question 35:

  The Falcon platform will show a maximum of how many detections per day for a single Agent Identifier (AID)?

  A. 500
  B. 750
  C. 1000
  D. 1200
  C. 1000

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon?Data Replicator (FDR) Add-on for Splunk Guide, the Falcon platform will show a maximum of 1000 detections per day for a single AID1. This is a limitimposed by the Falcon API, which is used to retrieve the detections from the CrowdStrike Cloud1. If there are more than 1000 detections per day for a single AID, only the first 1000 will be shown1.

• Question 36:

  You receive an email from a third-party vendor that one of their services is compromised, thevendor names a specific IP address that the compromised service was using. Where would you input this indicator to find any activity related to this IP address?

  A. IP Addresses
  B. Remote or Network Logon Activity
  C. Remote Access Graph
  D. Hash Executions
  A. IP Addresses

  ---

  Explanation/Reference:

  According to the [CrowdStrike website], the Discover page is where you can search for and analyze various types of indicators of compromise (IOCs), such as hashes, IP addresses, or domains that are associated with malicious activities. You can use various tools, such as Hash Executions, IP Addresses, Remote or Network Logon Activity, etc., to perform different types of searches and view the results in different ways. If you want to search for any activity related to an IP address that was compromised by a third-party vendor, you can use the IP Addresses tool to do so. You can input the IP address and see a summary of information from Falcon events that contain that IP address, such as hostname, sensor ID, OS, country, city, ISP, ASN, geolocation, process name, command line, and organizational unit of the host that communicated with that IP address.

• Question 37:

  When examining raw event data, what is the purpose of the field called ParentProcessld_decimal?

  A. It contains an internal value not useful for an investigation
  B. It contains the TargetProcessld_decimal value of the child process
  C. It contains the Sensorld_decimal value for related events
  D. It contains the TargetProcessld_decimal of the parent process
  D. It contains the TargetProcessld_decimal of the parent process

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the ParentProcessld_decimal field contains the decimal value of the process ID of the parent process that spawned or injected into the target process1. This field can be used to trace the process lineage and identify malicious or suspicious activities1.

• Question 38:

  How are processes on the same plane ordered (bottom 'VMTOOLSD.EXE' to top CMD.EXE')?

  

  A. Process ID (Descending, highest on bottom)
  B. Time started (Descending, most recent on bottom)
  C. Time started (Ascending, most recent on top)
  D. Process ID (Ascending, highest on top)
  B. Time started (Descending, most recent on bottom)

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the process tree view provides a visualization of program ancestry, which shows the parent-child and sibling relationships among the processes1. You can also see the event types and timestamps for each process1. The processes on the same plane are ordered by time started in descending order, meaning that the most recent process is at the bottom and the oldest process is at the top1. For example, in the image you sent me, CMD.EXE is the oldest process and VMTOOLSD.EXE is the most recent process on that plane1.

• Question 39:

  You are reviewing the raw data in an event search from a detection tree. You find a FileOpenlnfo event and want to find out if any other files were opened by the responsible process. Which two field values do you need from this event to perform a Process Timeline search?

  A. ParentProcessld_decimal and aid
  B. ResponsibleProcessld_decimal and aid
  C. ContextProcessld_decimal and aid
  D. TargetProcessld_decimal and aid
  D. TargetProcessld_decimal and aid

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Process Timeline tool allows you to view all cloudable events associated with a given process, such as process creation, network connections, file writes, registry modifications, etc2. The tool requires two parameters: aid (agent ID) and TargetProcessId_decimal (the decimal value of the process ID)2. These fields can be obtained from any event that involves the process, such as a FileOpenInfo event, which contains information about a file being opened by a process2.

• Question 40:

  What is an advantage of using the IP Search tool?

  A. IP searches provide manufacture and timezone data that can not be accessed anywhere else
  B. IP searches allow for multiple comma separated IPv6 addresses as input
  C. IP searches offer shortcuts to launch response actions and network containment on target hosts
  D. IP searches provide host, process, and organizational unit data without the need to write a query
  D. IP searches provide host, process, and organizational unit data without the need to write a query

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the IP Search tool allows you to search for an IP address and view a summary of information from Falcon events that contain that IP address1. The summary includes the hostname, sensor ID, OS, country, city, ISP, ASN, geolocation, process name, command line, and organizational unit of the host that communicated with that IP address1. This is an advantage of using the IP Search tool because it provides host, process, and organizational unit data without the need to write a query1.