2025 Latest CCFR-201 dumps Exam Material with 63 Questions
CrowdStrike CCFR-201 Questions and Answers Guarantee you Oass the Test Easily
NEW QUESTION # 23
How long does detection data remain in the CrowdStrike Cloud before purging begins?
- A. 14 Days
- B. 45 Days
- C. 30 Days
- D. 90 Days
Answer: D
Explanation:
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, detection data is stored in the CrowdStrike Cloud for 90 days before purging begins2. This means that you can access and view detections from the past 90 days using the Falcon platform or API2. If you want to retain detection data for longer than 90 days, you can use FDR to replicate it to your own storage system2.
NEW QUESTION # 24
After pivoting to an event search from a detection, you locate the ProcessRollup2 event. Which two field values are you required to obtain to perform a Process Timeline search so you can determine what the process was doing?
- A. SHA256 and TargetProcessld_decimal
- B. SHA256 and ParentProcessld_decimal
- C. aid and TargetProcessld_decimal
- D. aid and ParentProcessld_decimal
Answer: C
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Process Timeline search requires two parameters: aid (agent ID) and TargetProcessId_decimal (the decimal value of the process ID). These fields can be obtained from the ProcessRollup2 event, which contains information about processes that have executed on a host1.
NEW QUESTION # 25
Which of the following is returned from the IP Search tool?
- A. IP Summary information from Falcon events containing the given IP
- B. Threat Graph Data for the given IP from Falcon sensors
- C. Unmanaged host data from system ARP tables for the given IPD.IP Detection Summary information for detection events containing the given IP
Answer: A
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the IP Search tool allows you to search for an IP address and view a summary of information from Falcon events that contain that IP address1. The summary includes the hostname, sensor ID, OS, country, city, ISP, ASN, and geolocation of the host that communicated with that IP address1.
NEW QUESTION # 26
You are reviewing the raw data in an event search from a detection tree. You find a FileOpenlnfo event and want to find out if any other files were opened by the responsible process. Which two field values do you need from this event to perform a Process Timeline search?
- A. ResponsibleProcessld_decimal and aid
- B. TargetProcessld_decimal and aid
- C. ContextProcessld_decimal and aid
- D. ParentProcessld_decimal and aid
Answer: B
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Process Timeline tool allows you to view all cloudable events associated with a given process, such as process creation, network connections, file writes, registry modifications, etc2. The tool requires two parameters: aid (agent ID) and TargetProcessId_decimal (the decimal value of the process ID)2. These fields can be obtained from any event that involves the process, such as a FileOpenInfo event, which contains information about a file being opened by a process2.
NEW QUESTION # 27
What information does the MITRE ATT&CKFramework provide?
- A. It is a system that attributes an attack techniques to a specific threat actor
- B. It provides a step-by-step cyber incident response strategy
- C. It provides the phases of an adversary's lifecycle, the platforms they are known to attack, and the specific methods they use
- D. It provides best practices for different cybersecurity domains, such as Identify and Access Management
Answer: C
Explanation:
Explanation
According to the [MITRE ATT&CK website], MITRE ATT&CK is a knowledge base of adversary behaviors and techniques based on real-world observations. The knowledge base is organized into tactics and techniques, where tactics are the high-level goals of an adversary, such as initial access, persistence, lateral movement, etc., and techniques are the specific ways an adversary can achieve those goals, such as phishing, credential dumping, remote file copy, etc. The knowledge base also covers different platforms that adversaries target, such as Windows, Linux, Mac, Android, iOS, etc., and different phases of an adversary's lifecycle, such as reconnaissance, resource development, execution, command and control, etc.
NEW QUESTION # 28
In the Hash Search tool, which of the following is listed under Process Executions?
- A. Command Line
- B. Operating System
- C. Sensor Version
- D. File Signature
Answer: A
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Hash Search tool allows you to search for one or more SHA256 hashes and view a summary of information from Falcon events that contain those hashes1. The summary includes the hostname, sensor ID, OS, country, city, ISP, ASN, geolocation, process name, command line, and organizational unit of the host that loaded or executed those hashes1. You can also see a count of detections and incidents related to those hashes1. Under Process Executions, you can see the process name and command line for each hash execution1.
NEW QUESTION # 29
How does a DNSRequest event link to its responsible process?
- A. Via its TargetProcessld_decimal field
- B. Via its ContextProcessld_decimal field
- C. Via both its ContextProcessld__decimal and ParentProcessld_decimal fields
- D. Via its ParentProcessld_decimal field
Answer: B
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, a DNSRequest event contains information about a DNS query made by a process2. The event has several fields, such as DomainName, QueryType, QueryResponseCode, etc2. The field that links a DNSRequest event to its responsible process is ContextProcessId_decimal, which contains the decimal value of the process ID of the process that generated the event2. You can use this field to trace the process lineage and identify malicious or suspicious activities2.
NEW QUESTION # 30
Where can you find hosts that are in Reduced Functionality Mode?
- A. Installation Tokens
- B. Event Search
- C. Host Search
- D. Executive Summary dashboard
Answer: C
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, Reduced Functionality Mode (RFM) is a state where a host's sensor has limited functionality due to various reasons, such as license expiration, network issues, tampering attempts, etc1. You can find hosts that are in RFM by using the Host Search tool and filtering by Sensor Status = RFM1. You can also view details about why a host is in RFM by clicking on its hostname1.
NEW QUESTION # 31
How are processes on the same plane ordered (bottom 'VMTOOLSD.EXE' to top CMD.EXE')?
- A. Time started (Ascending, most recent on top)
- B. Process ID (Ascending, highest on top)
- C. Time started (Descending, most recent on bottom)
- D. Process ID (Descending, highest on bottom)
Answer: C
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the process tree view provides a visualization of program ancestry, which shows the parent-child and sibling relationships among the processes1. You can also see the event types and timestamps for each process1. The processes on the same plane are ordered by time started in descending order, meaning that the most recent process is at the bottom and the oldest process is at the top1. For example, in the image you sent me, CMD.EXE is the oldest process and VMTOOLSD.EXE is the most recent process on that plane1.
NEW QUESTION # 32
The primary purpose for running a Hash Search is to:
- A. review information surrounding a hash's related activity
- B. determine the origin of the detection
- C. review the processes involved with a detection
- D. determine any network connections
Answer: A
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Hash Search tool allows you to search for one or more SHA256 hashes and view a summary of information from Falcon events that contain those hashes1. The summary includes the hostname, sensor ID, OS, country, city, ISP, ASN, geolocation, process name, command line, and organizational unit of the host that loaded or executed those hashes1. You can also see a count of detections and incidents related to those hashes1. The primary purpose for running a Hash Search is to review information surrounding a hash's related activity, such as which hosts and processes were involved, where they were located, and whether they triggered any alerts1.
NEW QUESTION # 33
Which of the following is NOT a valid event type?
- A. EndofProcess
- B. StartofProcess
- C. ProcessRollup2
- D. DnsRequest
Answer: A
Explanation:
Explanation
According to the [CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+], event types are categories of events that are generated by the sensor for various activities, such as process executions, file writes, registry modifications, network connections, etc. There are many valid event types, such as StartOfProcess, ProcessRollup2, DnsRequest, etc. However, EndOfProcess is not a valid event type, as there is no such event that records the end of a process.
NEW QUESTION # 34
You notice that taskeng.exe is one of the processes involved in a detection. What activity should you investigate next?
- A. Scheduled tasks registered prior to the detection
- B. Pivot to a Hash search for taskeng.exe
- C. User logons after the detection
- D. Executions of schtasks.exe after the detection
Answer: A
Explanation:
Explanation
According to the [Microsoft website], taskeng.exe is a legitimate Windows process that is responsible for running scheduled tasks. However, some malware may use this process or create a fake one to execute malicious code. Therefore, if you notice taskeng.exe involved in a detection, you should investigate whether there are any scheduled tasks registered prior to the detection that may have triggered or injected into taskeng.exe. You can use tools such as schtasks.exe or Task Scheduler to view or manage scheduled tasks.
NEW QUESTION # 35
In the "Full Detection Details", which view will provide an exportable text listing of events like DNS requests.
Registry Operations, and Network Operations?
- A. View as Process Activity
- B. Thedata is unable to be exported
- C. View as Process Timeline
- D. View as Process Tree
Answer: A
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Full Detection Details tool allows you to view detailed information about a detection, such as detection ID, severity, tactic, technique, description, etc1. You can also view the events generated by the processes involved in the detection in different ways, such as process tree, process timeline, or process activity1. The process activity view provides a rows-and-columns style view of the events, such as DNS requests, registry operations, network operations, etc1. You can also export this view to a CSV file for further analysis1.
NEW QUESTION # 36
The function of Machine Learning Exclusions is to___________.
- A. stop all detections for a specific pattern ID
- B. stop all ML-based detections and preventions for the matching path(s) and/or stop files from being uploaded to the CrowdStrike Cloud
- C. Stop all Machine Learning Preventions but a detection will still be generated and files will still be uploaded to the CrowdStrike Cloud
- D. stop all sensor data collection for the matching path(s)
Answer: B
Explanation:
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, Machine Learning Exclusions allow you to exclude files or directories from being scanned by CrowdStrike's machine learning engine, which can reduce false positives and improveperformance2. You can also choose whether to upload the excluded files to the CrowdStrike Cloud or not2.
NEW QUESTION # 37
When analyzing an executable with a global prevalence of common; but you do not know what the executable is. what is the best course of action?
- A. From detection, submit to FalconX for deep dive analysis
- B. From detection, use API manager to create a custom blocklist
- C. Do nothing, as this file is common and well known
- D. From detection, click the VT Hash button to pivot to VirusTotal to investigate further
Answer: D
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, global prevalence is a field that indicates how frequently the hash of a file is seen across all CrowdStrike customer environments1. A global prevalence of common means that the file is widely distributed and likely benign1. However, if you do not know what the executable is, you may want to investigate it further to confirm its legitimacy and functionality1. One way to do that is to click the VT Hash button from the detection, which will pivot you to VirusTotal, a service that analyzes files and URLs for viruses, malware, and other threats1. You can then see more information about the file, such as its name, size, type, signatures, detections, comments, etc1.
NEW QUESTION # 38
How long are quarantined files stored on the host?
- A. 45 Days
- B. Quarantined files are never deleted from the host
- C. 30 Days
- D. 90 Days
Answer: B
Explanation:
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, quarantined files are never deleted from the host unless you manually delete them or release them from quarantine2. When you release a file from quarantine, you are restoring it to its original location and allowing it to execute on any host in your organization2. This action also removes the file from the quarantine list and deletes it from the CrowdStrike Cloud2.
NEW QUESTION # 39
The Bulk Domain Search tool contains Domain information along with which of the following?
- A. Process Information
- B. Threat Actor Information
- C. IP Lookup Information
- D. Port Information
Answer: C
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Bulk Domain Search tool allows you to search for one or more domains and view a summary of information from Falcon events that contain those domains1. The summary includes the domain name, IP address, country, city, ISP, ASN, geolocation, hostname, sensor ID, OS, process name, command line, and organizational unit of the host that communicated with those domains1. This means that the tool contains domain information along with IP lookup information1.
NEW QUESTION # 40
When you configure and apply an IOA exclusion, what impact does it have on the host and what you see in the console?
- A. The associated IOA will still generate a detection but the associated process would have been allowed to run
- B. The associated detection will be suppressed and the associated process would have been allowed to run
- C. The process specified is not sent to the Falcon Sandbox for analysis
- D. The sensor will stop sending events from the process specified in the regex pattern
Answer: B
Explanation:
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, IOA exclusions allow you to exclude files or directories from being detected or blocked by CrowdStrike's indicators of attack (IOAs), which are behavioral rules that identify malicious activities1. This can reduce false positives and improve performance1. When you configure and apply an IOA exclusion, the impact is that the associated detection will be suppressed and theassociated process would have been allowed to run1. This means that you will not see any alerts or events related to that IOA in the console1.
NEW QUESTION # 41
What is an advantage of using the IP Search tool?
- A. IP searches offer shortcuts to launch response actions and network containment on target hosts
- B. IP searches provide manufacture and timezone data that can not be accessed anywhere else
- C. IP searches allow for multiple comma separated IPv6 addresses as input
- D. IP searches provide host, process, and organizational unit data without the need to write a query
Answer: D
Explanation:
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the IP Search tool allows you to search for an IP address and view a summary of information from Falcon events that contain that IP address1. The summary includes the hostname, sensor ID, OS, country, city, ISP, ASN, geolocation, process name, command line, and organizational unit of the host that communicated with that IP address1. This is an advantage of using the IP Search tool because it provides host, process, and organizational unit data without the need to write a query1.
NEW QUESTION # 42
Which of the following is an example of a MITRE ATT&CK tactic?
- A. Eternal Blue
- B. Phishing
- C. Emotet
- D. Defense Evasion
Answer: D
Explanation:
Explanation
According to the [MITRE ATT&CK website], MITRE ATT&CK is a knowledge base of adversary behaviors and techniques based on real-world observations. The knowledge base is organized into tactics and techniques, where tactics are the high-level goals of an adversary, such as initial access, persistence, lateral movement, etc., and techniques are the specific ways an adversary can achieve those goals, such as phishing, credential dumping, remote file copy, etc. Defense Evasion is one of the tactics defined by MITRE ATT&CK, which covers actions that adversaries take to avoid detection or prevent security controls from blocking their activities. Eternal Blue, Emotet, and Phishing are examples of techniques, not tactics.
NEW QUESTION # 43
What happens when a quarantined file is released?
- A. It is allowed to execute on all hosts
- B. It is moved into theC:\CrowdStrike\Quarantine\Releasedfolder on the host
- C. It is allowed to execute on the host
- D. It is deleted
Answer: A
Explanation:
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, when you release a file from quarantine, you are restoring it to its original location and allowing it to execute on any host in your organization1. This action also removes the file from the quarantine list and deletes it from the CrowdStrike Cloud1.
NEW QUESTION # 44
What action is used when you want to save a prevention hash for later use?
- A. Always Block
- B. No Action
- C. Always Allow
- D. Never Block
Answer: A
Explanation:
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, the Always Block action allows you to block a file from executing on any host in your organization based on its hash value2. This action can be used to prevent known malicious files from running on your endpoints2.
NEW QUESTION # 45
What do IOA exclusions help you achieve?
- A. Reduce false positives of behavioral detections from IOA based detections based on a file hash
- B. Reduce false positives of behavioral detections from Custom IOA and OverWatch detections only
- C. Reduce false positives of behavioral detections from IOA based detections only
- D. Reduce false positives based on Next-Gen Antivirus settings in the Prevention Policy
Answer: C
Explanation:
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, IOA exclusions allow you to exclude files or directories from being detected or blocked by CrowdStrike's indicators of attack (IOAs), which are behavioral rules that identify malicious activities2. This can reduce false positives and improve performance2. IOA exclusions only apply to IOA based detections, not other types of detections such as machine learning, custom IOA, or OverWatch2.
NEW QUESTION # 46
Which of the following tactic and technique combinations is sourced from MITRE ATT&CK information?
- A. Malware via PUP
- B. Falcon Intel via Intelligence Indicator - Domain
- C. Machine Learning via Cloud-Based ML
- D. Credential Access via OS Credential Dumping
Answer: D
Explanation:
Explanation
According to the [MITRE ATT&CK website], MITRE ATT&CK is a knowledge base of adversary behaviors and techniques based on real-world observations. The knowledge base is organized into tactics and techniques, where tactics are the high-level goals of an adversary, such as initial access, persistence, lateral movement, etc., and techniques are the specific ways an adversary can achieve those goals, such as phishing, credential dumping, remote file copy, etc. Credential Access via OS Credential Dumping is an example of a tactic and technique combination sourced from MITRE ATT&CK information, which describes how adversaries can obtain credentials from operating system memory or disk storage by using tools such as Mimikatz or ProcDump.
NEW QUESTION # 47
Within the MITRE-Based Falcon Detections Framework, what is the correct way to interpret Keep Access > Persistence > Create Account?
- A. An adversary is trying to keep access through persistence using external remote services
- B. An adversary is trying to keep access through persistence by creating an account
- C. adversary is trying to keep access through persistence using application skimming
- D. An adversary is trying to keep access through persistence using browser extensions
Answer: B
Explanation:
Explanation
According to the [CrowdStrike website], the MITRE-Based Falcon Detections Framework is a way of categorizing and describing detections based on the MITRE ATT&CK knowledge base ofadversary behaviors and techniques. The framework uses three levels of granularity: category, tactic, and technique. The category is the highest level and represents the main objective of an adversary, such as initial access, execution, credential access, etc. The tactic is the second level and represents the sub-objective of an adversary within a category, such as persistence, privilege escalation, defense evasion, etc. The technique is the lowest level and represents the specific way an adversary can achieve a tactic, such as create account, modify registry, obfuscated files or information, etc. Therefore, the correct way to interpret Keep Access > Persistence > Create Account is that an adversary is trying to keep access through persistence by creating an account.
NEW QUESTION # 48
......
CrowdStrike CCFR-201 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
Share Latest CCFR-201 DUMP Questions and Answers: https://www.dumpsreview.com/CCFR-201-exam-dumps-review.html
PDF Dumps 2025 Exam Questions with Practice Test: https://drive.google.com/open?id=1GXuWo9cIYXkJl-quaCNcL8eKNKTomX7r
