CrowdStrike CCFR Certified Official Practice Test CCFR-201 – Mar-2025 [Q19-Q38]

4.3/5 - (3 votes)

CrowdStrike CCFR Certified Official Practice Test CCFR-201 – Mar-2025

Ace CrowdStrike CCFR-201 Certification with Actual Questions Mar 08, 2025 Updated

CrowdStrike CCFR-201 Exam Syllabus Topics:

Topic	Details
Topic 1	Real-Time Response (RTR): For Incident Responders and System Administrators, this section covers the technical capabilities of Real-Time Response. Candidates will understand how to utilize RTR to manage incidents effectively, including executing commands on remote systems, collecting forensic data, and performing system remediation tasks in real time.
Topic 2	Detection Analysis: Targeting SOC Analysts and Incident Responders, this comprehensive section covers the various aspects of Falcon detection analysis. It includes interpreting information from the Activity dashboard and Endpoint detections, determining appropriate responses based on detection sources, and utilizing OSINT tools. Candidates will be proficient in triaging detections, evaluating internal and external prevalence, and interpreting data from different processes.
Topic 3	Search Tools: Designed for Threat Intelligence Analysts and Forensic Investigators, this section delves into the use of various search tools within Falcon. Candidates are expected to analyze and interpret information from User, IP, Hash, and Host searches, as well as Bulk Domain searches.
Topic 4	ATT&CK Framework Application: For Security Analysts and Threat Hunters, this section emphasizes the importance of understanding the MITRE ATT&CK framework and its integration within the Falcon platform. Candidates will learn to interpret the information provided by the framework and apply its tactics and techniques to contextualize detections in Falcon.

Q19. What happens when a hash is set to Always Block through IOC Management?

Execution is prevented on all hosts by default

Execution is prevented on selected host groups

Execution is prevented and detection alerts are suppressed

The hash is submitted for approval to be blocked from execution once confirmed by Falcon specialists

Q20. Which is TRUE regarding a file released from quarantine?

No executions are allowed for 14 days after release

It is allowed to execute on all hosts

It is deleted

It will not generate future machine learning detections on the associated host

Q21. In the “Full Detection Details”, which view will provide an exportable text listing of events like DNS requests.
Registry Operations, and Network Operations?

Thedata is unable to be exported

View as Process Tree

View as Process Timeline

View as Process Activity

Q22. What action is used when you want to save a prevention hash for later use?

Always Allow

Never Block

No Action

Always Block

Q23. When you configure and apply an IOA exclusion, what impact does it have on the host and what you see in the console?

The process specified is not sent to the Falcon Sandbox for analysis

The associated detection will be suppressed and the associated process would have been allowed to run

The sensor will stop sending events from the process specified in the regex pattern

The associated IOA will still generate a detection but the associated process would have been allowed to run

Q24. What is the difference between Managed and Unmanaged Neighbors in the Falcon console?

A managed neighbor is currently network contained and an unmanaged neighbor is uncontained

A managed neighbor has an installed and provisioned sensor

An unmanaged neighbor is in a segmented area of the network

A managed sensor has an active prevention policy

Q25. You receive an email from a third-party vendor that one of their services is compromised,thevendor names a specific IP address that the compromised service was using. Where would you input this indicator to find any activity related to this IP address?

IP Addresses

Remote or Network Logon Activity

Remote Access Graph

Hash Executions

Q26. When analyzing an executable with a global prevalence of common; but you do not know what the executable is. what is the best course of action?

Do nothing, as this file is common and well known

From detection, click the VT Hash button to pivot to VirusTotal to investigate further

From detection, use API manager to create a custom blocklist

From detection, submit to FalconX for deep dive analysis

Q27. You are notified by a third-party that a program may have redirected traffic to a malicious domain. Which Falcon page will assist you in searching for any domain request information related to this notice?

Falcon X

Investigate

Discover

Spotlight

Q28. How long does detection data remain in the CrowdStrike Cloud before purging begins?

90 Days

45 Days

14 Days

30 Days

Q29. Where are quarantined files stored on Windows hosts?

WindowsQuarantine

WindowsSystem32DriversCrowdStrikeQuarantine

WindowsSystem32

WindowstempDriversCrowdStrikeQuarantine

Q30. Aside from a Process Timeline or Event Search, how do you export process event data from a detection in
.CSV format?

You can’t export detailed event data from a detection, you have to use the Process Timeline or an Event Search

In Full Detection Details, you expand the nodes of the process tree you wish to expand and then click the “Export Process Events” button

In Full Detection Details, you choose the “View Process Activity” option and then export from that view

From the Detections Dashboard, you right-click the event type you wish to export and choose CSV.JSON or XML

Q31. What does pivoting to an Event Search from a detection do?

It gives you the ability to search for similar events on other endpoints quickly

It takes you to the raw Insight event data and provides you with a number of Event Actions

It takes you to a Process Timeline for that detection so you can see all related events

It allows you to input an event type, such as DNS Request or ASEP write, and search for those events within the detection

Q32. When looking at the details of a detection, there are two fields called Global Prevalence and Local Prevalence.
Which answer best defines Local Prevalence?

Local prevalence is the frequency with which the hash of the triggering file is seen across the entire Internet

Local Prevalence tells you how common the hash of the triggering file is within your environment (CID)

Local Prevalence is the Virus Total score for the hash of the triggering file

Local prevalence is the frequency with which the hash of the triggering file is seen across all CrowdStrike customer environments

Q33. From a detection, what is the fastest way to see children and sibling process information?

Select the Event Search option. Then from the Event Actions, select Show Associated Event Data (From TargetProcessld_decimal)

Select Full Detection Details from the detection

Right-click the process and select “Follow Process Chain”

Select the Process Timeline feature, enter the AID. Target Process ID, and Parent Process ID

Q34. What types of events are returned by a Process Timeline?

Only detection events

All cloudable events

Only process events

Only network events

Q35. Which of the following is NOT a valid event type?

StartofProcess

EndofProcess

ProcessRollup2

DnsRequest

Q36. Sensor Visibility Exclusion patterns are written in which syntax?

Glob Syntax

Kleene Star Syntax

RegEx

SPL(Splunk)

Q37. You found a list of SHA256 hashes in an intelligence report and search for them using the Hash Execution Search. What can be determined from the results?

Identifies a detailed list of all process executions for the specified hashes

Identifies hosts that loaded or executed the specified hashes

Identifies users associated with the specified hashes

Identifies detections related to the specified hashes

Q38. How are processes on the same plane ordered (bottom ‘VMTOOLSD.EXE’ to top CMD.EXE’)?