CrowdStrike CCFR-201 Online Practice Questions and Exam Preparation

CrowdStrike CCFR-201 Online Questions & Answers

• Question 51:

  Which option indicates a hash is allowlisted?

  A. No Action
  B. Allow
  C. Ignore
  D. Always Block
  B. Allow

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon?Data Replicator (FDR) Add-on for Splunk Guide, the allowlist feature allows you to exclude files or directories from being scanned or blocked by CrowdStrike's machine learning engine or indicators of attack (IOAs)2. This can reduce false positives and improve performance2. When you allowlist a hash, you are allowing that file to execute on any host that belongs to your organization's CID (customer ID)2. The option to indicate that a hash is allowlisted is "Allow"2.

• Question 52:

  Within the MITRE-Based Falcon Detections Framework, what is the correct way to interpret Keep Access > Persistence > Create Account?

  A. An adversary is trying to keep access through persistence by creating an account
  B. An adversary is trying to keep access through persistence using browser extensions
  C. An adversary is trying to keep access through persistence using external remote services
  D. adversary is trying to keep access through persistence using application skimming
  A. An adversary is trying to keep access through persistence by creating an account

  ---

  Explanation/Reference:

  According to the [CrowdStrike website], the MITRE-Based Falcon Detections Framework is a way of categorizing and describing detections based on the MITRE ATTandCK knowledge base ofadversary behaviors and techniques. The framework uses three levels of granularity: category, tactic, and technique. The category is the highest level and represents the main objective of an adversary, such as initial access, execution, credential access, etc. The tactic is the second level and represents the sub-objective of an adversary within a category, such as persistence, privilege escalation, defense evasion, etc. The technique is the lowest level and represents the specific way an adversary can achieve a tactic, such as create account, modify registry, obfuscated files or information, etc. Therefore, the correct way to interpret Keep Access > Persistence > Create Account is that an adversary is trying to keep access through persistence by creating an account.

• Question 53:

  Where can you find hosts that are in Reduced Functionality Mode?

  A. Event Search
  B. Executive Summary dashboard
  C. Host Search
  D. Installation Tokens
  C. Host Search

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, Reduced Functionality Mode (RFM) is a state where a host's sensor has limited functionality due to various reasons, such as license expiration, network issues, tampering attempts, etc1. You can find hosts that are in RFM by using the Host Search tool and filtering by Sensor Status = RFM1. You can also view details about why a host is in RFM by clicking on its hostname1.

• Question 54:

  The function of Machine Learning Exclusions is to___________.

  A. stop all detections for a specific pattern ID
  B. stop all sensor data collection for the matching path(s)
  C. Stop all Machine Learning Preventions but a detection will still be generated and files will still be uploaded to the CrowdStrike Cloud
  D. stop all ML-based detections and preventions for the matching path(s) and/or stop files from being uploaded to the CrowdStrike Cloud
  D. stop all ML-based detections and preventions for the matching path(s) and/or stop files from being uploaded to the CrowdStrike Cloud

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon?Data Replicator (FDR) Add-on for Splunk Guide, Machine Learning Exclusions allow you to exclude files or directories from being scanned by CrowdStrike's machine learning engine, which can reduce false positives and improveperformance2. You can also choose whether to upload the excluded files to the CrowdStrike Cloud or not2.

• Question 55:

  What happens when a hash is set to Always Block through IOC Management?

  A. Execution is prevented on all hosts by default
  B. Execution is prevented on selected host groups
  C. Execution is prevented and detection alerts are suppressed
  D. The hash is submitted for approval to be blocked from execution once confirmed by Falcon specialists
  A. Execution is prevented on all hosts by default

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon?Data Replicator (FDR) Add-on for Splunk Guide, IOC Management allows you to manage indicators of compromise (IOCs), which are artifacts such as hashes, IP addresses, or domains that are associated with malicious activities2. You can set different actions for IOCs, such as Allow, No Action, or Always Block2. When you set a hash to Always Block through IOC Management, you are preventing that file from executing on any host in your organization by default2. This action also generates a detection alert when the file is blocked2.

• Question 56:

  In the Hash Search tool, which of the following is listed under Process Executions?

  A. Operating System
  B. File Signature
  C. Command Line
  D. Sensor Version
  C. Command Line

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Hash Search tool allows you to search for one or more SHA256 hashes and view a summary of information from Falcon events that contain those hashes1. The summary includes the hostname, sensor ID, OS, country, city, ISP, ASN, geolocation, process name, command line, and organizational unit of the host that loaded or executed those hashes1. You can also see a count of detections and incidents related to those hashes1. Under Process Executions, you can see the process name and command line for each hash execution1.

• Question 57:

  The Bulk Domain Search tool contains Domain information along with which of the following?

  A. Process Information
  B. Port Information
  C. IP Lookup Information
  D. Threat Actor Information
  C. IP Lookup Information

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Bulk Domain Search tool allows you to search for one or more domains and view a summary of information from Falcon events that contain those domains1. The summary includes the domain name, IP address, country, city, ISP, ASN, geolocation, hostname, sensor ID, OS, process name, command line, and organizational unit of the host that communicated with those domains1. This means that the tool contains domain information along with IP lookup information1.

• Question 58:

  Which of the following is NOT a valid event type?

  A. StartofProcess
  B. EndofProcess
  C. ProcessRollup2
  D. DnsRequest
  B. EndofProcess

  ---

  Explanation/Reference:

  According to the [CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+], event types are categories of events that are generated by the sensor for various activities, such as process executions, file writes, registry modifications, network connections, etc. There are many valid event types, such as StartOfProcess, ProcessRollup2, DnsRequest, etc. However, EndOfProcess is not a valid event type, as there is no such event that records the end of a process.

• Question 59:

  Where are quarantined files stored on Windows hosts?

  A. Windows\Quarantine
  B. Windows\System32\Drivers\CrowdStrike\Quarantine
  C. Windows\System32\
  D. Windows\temp\Drivers\CrowdStrike\Quarantine
  B. Windows\System32\Drivers\CrowdStrike\Quarantine

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon?Data Replicator (FDR) Add-on for Splunk Guide, when you quarantine a file from a host using IOC Management or Real Time Response (RTR), you are moving it from its original location to a secure location on the host where it cannot be executed2. The file is also encrypted and renamed with a random string of characters2. On Windows hosts, quarantined files are stored in C:\Windows\System32\Drivers\CrowdStrike\Quarantine folder2.

• Question 60:

  When reviewing a Host Timeline, which of the following filters is available?

  A. Severity
  B. Event Types
  C. User Name
  D. Detection ID
  B. Event Types

  ---

  Explanation/Reference:

  According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Host Timeline tool allows you to view all events recorded by the sensor for a given host in a chronological order1. The events include process executions, file writes, registry modifications, network connections, user logins, etc1. You can use various filters to narrow down the events based on criteria such as event type, timestamp range, file name, registry key, network destination, etc1. However, there is no filter for severity, user name, or detection ID, as these are not attributes of the events1.