Study HIGH Quality CCFR-201 Free Study Guides and Exams Tutorials
Download CrowdStrike CCFR-201 Exam Dumps to Pass Exam Easily
NEW QUESTION # 21
When you configure and apply an IOA exclusion, what impact does it have on the host and what you see in the console?
- A. The process specified is not sent to the Falcon Sandbox for analysis
- B. The associated IOA will still generate a detection but the associated process would have been allowed to run
- C. The sensor will stop sending events from the process specified in the regex pattern
- D. The associated detection will be suppressed and the associated process would have been allowed to run
Answer: D
Explanation:
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, IOA exclusions allow you to exclude files or directories from being detected or blocked by CrowdStrike's indicators of attack (IOAs), which are behavioral rules that identify malicious activities1. This can reduce false positives and improve performance1. When you configure and apply an IOA exclusion, the impact is that the associated detection will be suppressed and theassociated process would have been allowed to run1. This means that you will not see any alerts or events related to that IOA in the console1.
NEW QUESTION # 22
The Process Activity View provides a rows-and-columns style view of the events generated in a detection.
Why might this be helpful?
- A. The Process Activity View creates a consolidated view of all detection events for that process that can be exported for further analysis
- B. The Process Activity View will show the Detection time of the earliest recorded activity which might indicate first affected machine
- C. The Process Activity View only creates a summary of Dynamic Link Libraries (DLLs) loaded by a process
- D. The Process Activity View creates a count of event types only, which can be useful when scoping the event
Answer: A
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Process Activity View allows you to view all events generated by a process involved in a detection in a rows-and-columns style view1. This can be helpful because it creates a consolidated view of all detection events for that process that can be exported for further analysis1. You can also sort, filter, and pivot on the events by various fields, such as event type, timestamp, file name, registry key, network destination, etc1.
NEW QUESTION # 23
Which statement is TRUE regarding the "Bulk Domains" search?
- A. It will show a list of computers and process that performed a lookup of any of the domains in your search
- B. The "Bulk Domains" search will allow you to blocklist your queried domains
- C. The "Bulk Domains" search will show IP address and port information for any associated connectionsD.You should only pivot to the "Bulk Domains" search tool after completing an investigation
Answer: A
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Bulk Domain Search tool allows you to search for one or more domains and view a summary of information from Falcon events that contain those domains2. The summary includes the hostname, sensor ID, OS, country, city, ISP, ASN, geolocation, process name, command line, and organizational unit of the host that performed a lookup of any of the domains in your search2. This can help you identify potential threats or vulnerabilities in your network2.
NEW QUESTION # 24
Which of the following is NOT a valid event type?
- A. StartofProcess
- B. EndofProcess
- C. ProcessRollup2
- D. DnsRequest
Answer: B
Explanation:
Explanation
According to the [CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+], event types are categories of events that are generated by the sensor for various activities, such as process executions, file writes, registry modifications, network connections, etc. There are many valid event types, such as StartOfProcess, ProcessRollup2, DnsRequest, etc. However, EndOfProcess is not a valid event type, as there is no such event that records the end of a process.
NEW QUESTION # 25
You notice that taskeng.exe is one of the processes involved in a detection. What activity should you investigate next?
- A. Pivot to a Hash search for taskeng.exe
- B. Executions of schtasks.exe after the detection
- C. User logons after the detection
- D. Scheduled tasks registered prior to the detection
Answer: D
Explanation:
Explanation
According to the [Microsoft website], taskeng.exe is a legitimate Windows process that is responsible for running scheduled tasks. However, some malware may use this process or create a fake one to execute malicious code. Therefore, if you notice taskeng.exe involved in a detection, you should investigate whether there are any scheduled tasks registered prior to the detection that may have triggered or injected into taskeng.exe. You can use tools such as schtasks.exe or Task Scheduler to view or manage scheduled tasks.
NEW QUESTION # 26
Which is TRUE regarding a file released from quarantine?
- A. It is deleted
- B. It will not generate future machine learning detections on the associated host
- C. It is allowed to execute on all hosts
- D. No executions are allowed for 14 days after release
Answer: C
Explanation:
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, when you release a file from quarantine, you are restoring it to its original location and allowing it to execute on any host in your organization2. This action also removes the file from the quarantine list and deletes it from the CrowdStrike Cloud2.
NEW QUESTION # 27
From the Detections page, how can you view 'in-progress' detections assigned to Falcon Analyst Alex?
- A. Alex does not have the correct role permissions as a Falcon Analyst to be assigned detections
- B. Filter on 'Hostname: Alex' and 'Status: In-Progress'
- C. Filter on'Analyst: Alex'
- D. Filter on 'Status: In-Progress' and 'Assigned-to: Alex*
Answer: D
Explanation:
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, the Detections page allows you to view and manage detections generated by the CrowdStrike Falcon platform2. You can use various filters to narrow down the detections based on criteria such asstatus, severity, tactic, technique, etc2. To view 'in-progress' detections assigned to Falcon Analyst Alex, you can filter on 'Status: In-Progress' and 'Assigned-to: Alex*'2. The asterisk (*) is a wildcard that matches any characters after Alex2.
NEW QUESTION # 28
You are notified by a third-party that a program may have redirected traffic to a malicious domain. Which Falcon page will assist you in searching for any domain request information related to this notice?
- A. Investigate
- B. Spotlight
- C. Falcon X
- D. Discover
Answer: A
Explanation:
Explanation
According to the [CrowdStrike website], the Investigate page is where you can search for and analyze various types of data collected by the Falcon platform, such as events, hosts, processes, hashes, domains, IPs, etc1. You can use various tools, such as Event Search, Host Search, Process Timeline, Hash Search, Bulk Domain Search, etc., to perform different types of searches and view the results in different ways1. If you want to search for any domain request information related to a notice from a third-party, you can use the Investigate page to do so1. For example, you can use the Bulk Domain Search tool to search for the malicious domain and see which hosts and processes communicated with it1. You can also use the Event Search tool to search for DNSRequest events that contain the malicious domain and see more details about the query and response1.
NEW QUESTION # 29
Which of the following is returned from the IP Search tool?
- A. Unmanaged host data from system ARP tables for the given IPD.IP Detection Summary information for detection events containing the given IP
- B. IP Summary information from Falcon events containing the given IP
- C. Threat Graph Data for the given IP from Falcon sensors
Answer: B
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the IP Search tool allows you to search for an IP address and view a summary of information from Falcon events that contain that IP address1. The summary includes the hostname, sensor ID, OS, country, city, ISP, ASN, and geolocation of the host that communicated with that IP address1.
NEW QUESTION # 30
Which of the following tactic and technique combinations is sourced from MITRE ATT&CK information?
- A. Credential Access via OS Credential Dumping
- B. Malware via PUP
- C. Falcon Intel via Intelligence Indicator - Domain
- D. Machine Learning via Cloud-Based ML
Answer: A
Explanation:
Explanation
According to the [MITRE ATT&CK website], MITRE ATT&CK is a knowledge base of adversary behaviors and techniques based on real-world observations. The knowledge base is organized into tactics and techniques, where tactics are the high-level goals of an adversary, such as initial access, persistence, lateral movement, etc., and techniques are the specific ways an adversary can achieve those goals, such as phishing, credential dumping, remote file copy, etc. Credential Access via OS Credential Dumping is an example of a tactic and technique combination sourced from MITRE ATT&CK information, which describes how adversaries can obtain credentials from operating system memory or disk storage by using tools such as Mimikatz or ProcDump.
NEW QUESTION # 31
What is an advantage of using the IP Search tool?
- A. IP searches allow for multiple comma separated IPv6 addresses as input
- B. IP searches offer shortcuts to launch response actions and network containment on target hosts
- C. IP searches provide manufacture and timezone data that can not be accessed anywhere else
- D. IP searches provide host, process, and organizational unit data without the need to write a query
Answer: D
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the IP Search tool allows you to search for an IP address and view a summary of information from Falcon events that contain that IP address1. The summary includes the hostname, sensor ID, OS, country, city, ISP, ASN, geolocation, process name, command line, and organizational unit of the host that communicated with that IP address1. This is an advantage of using the IP Search tool because it provides host, process, and organizational unit data without the need to write a query1.
NEW QUESTION # 32
You are reviewing the raw data in an event search from a detection tree. You find a FileOpenlnfo event and want to find out if any other files were opened by the responsible process. Which two field values do you need from this event to perform a Process Timeline search?
- A. ContextProcessld_decimal and aid
- B. ParentProcessld_decimal and aid
- C. TargetProcessld_decimal and aid
- D. ResponsibleProcessld_decimal and aid
Answer: C
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Process Timeline tool allows you to view all cloudable events associated with a given process, such as process creation, network connections, file writes, registry modifications, etc2. The tool requires two parameters: aid (agent ID) and TargetProcessId_decimal (the decimal value of the process ID)2. These fields can be obtained from any event that involves the process, such as a FileOpenInfo event, which contains information about a file being opened by a process2.
NEW QUESTION # 33
What is the difference between a Host Search and a Host Timeline?
- A. Results from a Host Search return information in an organized view by type, while a Host Timeline returns a view of all events recorded by the sensor
- B. Results from a Host Timeline include process executions and related events organized by data type. A Host Search returns a temporal view of all events for the given host
- C. A Host Timeline only includes process execution events and user account activity
- D. There is no difference - Host Search and Host Timeline are different names for the same search page
Answer: A
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Host Search allows you to search for hosts based on various criteria, such as hostname, IP address, OS, etc1. The results are displayed in an organized view by type, such as detections, incidents, processes, network connections, etc1. The Host Timeline allows you to view all events recorded by the sensor for a given host in a chronological order1. The events include process executions, file writes, registry modifications, network connections, user logins, etc1.
NEW QUESTION # 34
What happens when a hash is allowlisted?
- A. Execution is prevented, but detection alerts are suppressed
- B. Execution is allowed on all hosts that fall under the organization's CID
- C. Execution is allowed on all hosts, including all other Falcon customers
- D. The hash is submitted for approval to be allowed to execute once confirmed by Falcon specialists
Answer: B
Explanation:
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, the allowlist feature allows you to exclude files or directories from being scanned or blocked by CrowdStrike's machine learning engine or indicators of attack (IOAs)2. This can reduce false positives and improve performance2. When you allowlist a hash, you are allowing that file to execute on any host that belongs to your organization's CID (customer ID)2. This does not affect other Falcon customers or hosts outside your CID2.
NEW QUESTION # 35
The Bulk Domain Search tool contains Domain information along with which of the following?
- A. Port Information
- B. Process Information
- C. Threat Actor Information
- D. IP Lookup Information
Answer: D
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Bulk Domain Search tool allows you to search for one or more domains and view a summary of information from Falcon events that contain those domains1. The summary includes the domain name, IP address, country, city, ISP, ASN, geolocation, hostname, sensor ID, OS, process name, command line, and organizational unit of the host that communicated with those domains1. This means that the tool contains domain information along with IP lookup information1.
NEW QUESTION # 36
What happens when a quarantined file is released?
- A. It is deleted
- B. It is moved into theC:\CrowdStrike\Quarantine\Releasedfolder on the host
- C. It is allowed to execute on the host
- D. It is allowed to execute on all hosts
Answer: D
Explanation:
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, when you release a file from quarantine, you are restoring it to its original location and allowing it to execute on any host in your organization1. This action also removes the file from the quarantine list and deletes it from the CrowdStrike Cloud1.
NEW QUESTION # 37
In the Hash Search tool, which of the following is listed under Process Executions?
- A. Operating System
- B. Command Line
- C. Sensor Version
- D. File Signature
Answer: B
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Hash Search tool allows you to search for one or more SHA256 hashes and view a summary of information from Falcon events that contain those hashes1. The summary includes the hostname, sensor ID, OS, country, city, ISP, ASN, geolocation, process name, command line, and organizational unit of the host that loaded or executed those hashes1. You can also see a count of detections and incidents related to those hashes1. Under Process Executions, you can see the process name and command line for each hash execution1.
NEW QUESTION # 38
When examining raw event data, what is the purpose of the field called ParentProcessld_decimal?
- A. It contains the TargetProcessld_decimal of the parent process
- B. It contains the Sensorld_decimal value for related events
- C. It contains the TargetProcessld_decimal value of the child process
- D. It contains an internal value not useful for an investigation
Answer: A
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the ParentProcessld_decimal field contains the decimal value of the process ID of the parent process that spawned or injected into the target process1. This field can be used to trace the process lineage and identify malicious or suspicious activities1.
NEW QUESTION # 39
What types of events are returned by a Process Timeline?
- A. All cloudable events
- B. Only process events
- C. Only network events
- D. Only detection events
Answer: A
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Process Timeline search returns all cloudable events associated with a given process, such as process creation, network connections, file writes, registry modifications, etc1. This allows you to see a comprehensive view of what a process was doing on a host1.
NEW QUESTION # 40
Within the MITRE-Based Falcon Detections Framework, what is the correct way to interpret Keep Access > Persistence > Create Account?
- A. An adversary is trying to keep access through persistence using browser extensions
- B. adversary is trying to keep access through persistence using application skimming
- C. An adversary is trying to keep access through persistence by creating an account
- D. An adversary is trying to keep access through persistence using external remote services
Answer: C
Explanation:
Explanation
According to the [CrowdStrike website], the MITRE-Based Falcon Detections Framework is a way of categorizing and describing detections based on the MITRE ATT&CK knowledge base ofadversary behaviors and techniques. The framework uses three levels of granularity: category, tactic, and technique. The category is the highest level and represents the main objective of an adversary, such as initial access, execution, credential access, etc. The tactic is the second level and represents the sub-objective of an adversary within a category, such as persistence, privilege escalation, defense evasion, etc. The technique is the lowest level and represents the specific way an adversary can achieve a tactic, such as create account, modify registry, obfuscated files or information, etc. Therefore, the correct way to interpret Keep Access > Persistence > Create Account is that an adversary is trying to keep access through persistence by creating an account.
NEW QUESTION # 41
In the "Full Detection Details", which view will provide an exportable text listing of events like DNS requests.
Registry Operations, and Network Operations?
- A. View as Process Timeline
- B. View as Process Tree
- C. Thedata is unable to be exported
- D. View as Process Activity
Answer: D
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Full Detection Details tool allows you to view detailed information about a detection, such as detection ID, severity, tactic, technique, description, etc1. You can also view the events generated by the processes involved in the detection in different ways, such as process tree, process timeline, or process activity1. The process activity view provides a rows-and-columns style view of the events, such as DNS requests, registry operations, network operations, etc1. You can also export this view to a CSV file for further analysis1.
NEW QUESTION # 42
......
Get 100% Real Free CrowdStrike CCFR CCFR-201 Sample Questions: https://www.actualtorrent.com/CCFR-201-questions-answers.html
Accurate CCFR-201 Questions with Free and Fast Updates: https://drive.google.com/open?id=18Wd0r2oDpc07eaGDFaci7o_w_rK2fBpk