CrowdStrike CCFR-201 Online Practice Questions and Exam Preparation

CrowdStrike CCFR-201 Online Questions & Answers

• Question 41:

  Sensor Visibility Exclusion patterns are written in which syntax?

  A. Glob Syntax
  B. Kleene Star Syntax
  C. RegEx
  D. SPL(Splunk)
  A. Glob Syntax

  ---

  Explanation/Reference:

  According to the [CrowdStrike Falcon?Data Replicator (FDR) Add-on for Splunk Guide], Sensor Visibility Exclusions allow you to exclude files or directories from being monitored by the sensor. This can reduce the amount of data sent to the CrowdStrike Cloud and improve performance. Sensor Visibility Exclusion patterns are written in Glob Syntax, which is a simple pattern matching syntax that supports wildcards, such as *, ?, and . For example, you can use *.exe to exclude all files with .exe extension.

• Question 42:

  From a detection, what is the fastest way to see children and sibling process information?

  A. Select the Event Search option. Then from the Event Actions, select Show Associated Event Data (From TargetProcessld_decimal)
  B. Select Full Detection Details from the detection
  C. Right-click the process and select "Follow Process Chain"
  D. Select the Process Timeline feature, enter the AID. Target Process ID, and Parent Process ID
  B. Select Full Detection Details from the detection

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon?Data Replicator (FDR) Add-on for Splunk Guide, the Full Detection Details tool allows you to view detailed information about a detection, such as detection ID, severity, tactic, technique, description, etc1. You can also view the events generated by the processes involved in the detection in different ways, such as process tree, process timeline, or process activity1. The process tree view provides a graphical representation of the process hierarchy and activity1. You can see children and sibling processes information by expanding or collapsing nodes in the tree1.

• Question 43:

  What information does the MITRE ATTandCKFramework provide?

  A. It provides best practices for different cybersecurity domains, such as Identify and Access Management
  B. It provides a step-by-step cyber incident response strategy
  C. It provides the phases of an adversary's lifecycle, the platforms they are known to attack, and the specific methods they use
  D. It is a system that attributes an attack techniques to a specific threat actor
  C. It provides the phases of an adversary's lifecycle, the platforms they are known to attack, and the specific methods they use

  ---

  Explanation/Reference:

  According to the [MITRE ATTandCK website], MITRE ATTandCK is a knowledge base of adversary behaviors and techniques based on real-world observations. The knowledge base is organized into tactics and techniques, where tactics are the high-level goals of an adversary, such as initial access, persistence, lateral movement, etc., and techniques are the specific ways an adversary can achieve those goals, such as phishing, credential dumping, remote file copy, etc. The knowledge base also covers different platforms that adversaries target, such as Windows, Linux, Mac, Android, iOS, etc., and different phases of an adversary's lifecycle, such as reconnaissance, resource development, execution, command and control, etc.

• Question 44:

  What is the difference between Managed and Unmanaged Neighbors in the Falcon console?

  A. A managed neighbor is currently network contained and an unmanaged neighbor is uncontained
  B. A managed neighbor has an installed and provisioned sensor
  C. An unmanaged neighbor is in a segmented area of the network
  D. A managed sensor has an active prevention policy
  B. A managed neighbor has an installed and provisioned sensor

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon?Data Replicator (FDR) Add-on for Splunk Guide, you can use the Hosts page in the Investigate tool to view information about your endpoints, such as hostname, IP address, OS, sensor version, etc2. You can also see a list of managed and unmanaged neighbors for each endpoint, which are other devices that have communicated with that endpoint over the network2. A managed neighbor is a device that has an installed and provisioned sensor that reports to the CrowdStrike Cloud2. An unmanaged neighbor is a device that does not have an installed or provisioned sensor2.

• Question 45:

  What happens when you open the full detection details?

  A. Theprocess explorer opens and the detection is removed from the console
  B. The process explorer opens and you're able to view the processes and process relationships
  C. The process explorer opens and the detection copies to the clipboard
  D. The process explorer opens and the Event Search query is run for the detection
  B. The process explorer opens and you're able to view the processes and process relationships

  ---

  Explanation/Reference:

  According to the [CrowdStrike Falcon?Data Replicator (FDR) Add-on for Splunk Guide], when you open the full detection details from a detection alert or dashboard item, you are taken to a page where you can view detailed information about the detection, such as detection ID, severity, tactic, technique, description, etc. You can also view the events generated by the processes involved in the detection in different ways, such as process tree, process timeline, or process activity. The process tree view is also known as the process explorer, which provides a graphical representation of the process hierarchy and activity. You can view the processes and process relationships by expanding or collapsing nodes in the tree. You can also see the event types and timestamps for each process.

• Question 46:

  Aside from a Process Timeline or Event Search, how do you export process event data from a detection in .CSV format?

  A. You can't export detailed event data from a detection, you have to use the Process Timeline or an Event Search
  B. In Full Detection Details, you expand the nodes of the process tree you wish to expand and then click the "Export Process Events" button
  C. In Full Detection Details, you choose the "View Process Activity" option and then export from that view
  D. From the Detections Dashboard, you right-click the event type you wish to export and choose CSV. JSON or XML
  C. In Full Detection Details, you choose the "View Process Activity" option and then export from that view

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, there are three ways to export process event data from a detection in .CSV format1:

  You can use the Process Timeline tool and click on "Export CSV" button at the top right corner1.

  You can use the Event Search tool and select one or more events and click on "Export CSV" button at the top right corner1.

  You can use the Full Detection Details tool and choose the "View Process Activity" option from any process node in the process tree view1. This will show you all events generated bythat process in a rows-and-columns style view1. You can

  then click on "Export CSV" button at the top right corner1.

• Question 47:

  You notice that taskeng.exe is one of the processes involved in a detection. What activity should you investigate next?

  A. User logons after the detection
  B. Executions of schtasks.exe after the detection
  C. Scheduled tasks registered prior to the detection
  D. Pivot to a Hash search for taskeng.exe
  C. Scheduled tasks registered prior to the detection

  ---

  Explanation/Reference:

  According to the [Microsoft website], taskeng.exe is a legitimate Windows process that is responsible for running scheduled tasks. However, some malware may use this process or create a fake one to execute malicious code. Therefore, if you notice taskeng.exe involved in a detection, you should investigate whether there are any scheduled tasks registered prior to the detection that may have triggered or injected into taskeng.exe. You can use tools such as schtasks.exe or Task Scheduler to view or manage scheduled tasks.

• Question 48:

  What happens when a hash is allowlisted?

  A. Execution is prevented, but detection alerts are suppressed
  B. Execution is allowed on all hosts, including all other Falcon customers
  C. The hash is submitted for approval to be allowed to execute once confirmed by Falcon specialists
  D. Execution is allowed on all hosts that fall under the organization's CID
  D. Execution is allowed on all hosts that fall under the organization's CID

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon?Data Replicator (FDR) Add-on for Splunk Guide, the allowlist feature allows you to exclude files or directories from being scanned or blocked by CrowdStrike's machine learning engine or indicators of attack (IOAs)2. This can reduce false positives and improve performance2. When you allowlist a hash, you are allowing that file to execute on any host that belongs to your organization's CID (customer ID)2. This does not affect other Falcon customers or hosts outside your CID2.

• Question 49:

  Which of the following tactic and technique combinations is sourced from MITRE ATTandCK information?

  A. Falcon Intel via Intelligence Indicator - Domain
  B. Machine Learning via Cloud-Based ML
  C. Malware via PUP
  D. Credential Access via OS Credential Dumping
  D. Credential Access via OS Credential Dumping

  ---

  Explanation/Reference:

  According to the [MITRE ATTandCK website], MITRE ATTandCK is a knowledge base of adversary behaviors and techniques based on real-world observations. The knowledge base is organized into tactics and techniques, where tactics are the high-level goals of an adversary, such as initial access, persistence, lateral movement, etc., and techniques are the specific ways an adversary can achieve those goals, such as phishing, credential dumping, remote file copy, etc. Credential Access via OS Credential Dumping is an example of a tactic and technique combination sourced from MITRE ATTandCK information, which describes how adversaries can obtain credentials from operating system memory or disk storage by using tools such as Mimikatz or ProcDump.

• Question 50:

  How long are quarantined files stored on the host?

  A. 45 Days
  B. 30 Days
  C. Quarantined files are never deleted from the host
  D. 90 Days
  C. Quarantined files are never deleted from the host

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon?Data Replicator (FDR) Add-on for Splunk Guide, quarantined files are never deleted from the host unless you manually delete them or release them from quarantine2. When you release a file from quarantine, you are restoring it to its original location and allowing it to execute on any host in your organization2. This action also removes the file from the quarantine list and deletes it from the CrowdStrike Cloud2.