Use Real CrowdStrike Achieve the CCFR-201 Dumps – 100% Exam Passing Guarantee [Q21-Q42] – IT Certification Exam Questions & Answers

Rate this post

Use Real CrowdStrike Achieve the CCFR-201 Dumps – 100% Exam Passing Guarantee

Verified CCFR-201 Q&As – Pass Guarantee CCFR-201 Exam Dumps

QUESTION 21
How long does detection data remain in the CrowdStrike Cloud before purging begins?

90 Days

45 Days

14 Days

30 Days

QUESTION 22
What is the difference between a Host Search and a Host Timeline?

Results from a Host Search return information in an organized view by type, while a Host Timeline returns a view of all events recorded by the sensor

A Host Timeline only includes process execution events and user account activity

Results from a Host Timeline include process executions and related events organized by data type. A Host Search returns a temporal view of all events for the given host

There is no difference – Host Search and Host Timeline are different names for the same search page

QUESTION 23
From the Detections page, how can you view ‘in-progress’ detections assigned to Falcon Analyst Alex?

Filter on’Analyst: Alex’

Alex does not have the correct role permissions as a Falcon Analyst to be assigned detections

Filter on ‘Hostname: Alex’ and ‘Status: In-Progress’

Filter on ‘Status: In-Progress’ and ‘Assigned-to: Alex*

QUESTION 24
Where are quarantined files stored on Windows hosts?

WindowsQuarantine

WindowsSystem32DriversCrowdStrikeQuarantine

WindowsSystem32

WindowstempDriversCrowdStrikeQuarantine

QUESTION 25
When reviewing a Host Timeline, which of the following filters is available?

Severity

Event Types

User Name

Detection ID

QUESTION 26
What is an advantage of using the IP Search tool?

IP searches provide manufacture and timezone data that can not be accessed anywhere else

IP searches allow for multiple comma separated IPv6 addresses as input

IP searches offer shortcuts to launch response actions and network containment on target hosts

IP searches provide host, process, and organizational unit data without the need to write a query

QUESTION 27
From a detection, what is the fastest way to see children and sibling process information?

Select the Event Search option. Then from the Event Actions, select Show Associated Event Data (From TargetProcessld_decimal)

Select Full Detection Details from the detection

Right-click the process and select “Follow Process Chain”

Select the Process Timeline feature, enter the AID. Target Process ID, and Parent Process ID

QUESTION 28
Where can you find hosts that are in Reduced Functionality Mode?

Event Search

Executive Summary dashboard

Host Search

Installation Tokens

QUESTION 29
What information does the MITRE ATT&CKFramework provide?

It provides best practices for different cybersecurity domains, such as Identify and Access Management

It provides a step-by-step cyber incident response strategy

It provides the phases of an adversary’s lifecycle, the platforms they are known to attack, and the specific methods they use

It is a system that attributes an attack techniques to a specific threat actor

QUESTION 30
When examining raw event data, what is the purpose of the field called ParentProcessld_decimal?

It contains an internal value not useful for an investigation

It contains the TargetProcessld_decimal value of the child process

It contains the Sensorld_decimal value for related events

It contains the TargetProcessld_decimal of the parent process

QUESTION 31
After pivoting to an event search from a detection, you locate the ProcessRollup2 event. Which two field values are you required to obtain to perform a Process Timeline search so you can determine what the process was doing?

SHA256 and TargetProcessld_decimal

SHA256 and ParentProcessld_decimal

aid and ParentProcessld_decimal

aid and TargetProcessld_decimal

QUESTION 32
Which of the following is NOT a filter available on the Detections page?

Severity

CrowdScore

Time

Triggering File

QUESTION 33
When analyzing an executable with a global prevalence of common; but you do not know what the executable is. what is the best course of action?

Do nothing, as this file is common and well known

From detection, click the VT Hash button to pivot to VirusTotal to investigate further

From detection, use API manager to create a custom blocklist

From detection, submit to FalconX for deep dive analysis

QUESTION 34
Which is TRUE regarding a file released from quarantine?

It is allowed to execute on all hosts

It is deleted

No executions are allowed for 14 days after release

It will not generate future machine learning detections on the associated host

QUESTION 35
How long does detection data remain in the CrowdStrike Cloud before purging begins?

90 Days

45 Days

30 Days

14 Days

QUESTION 36
You are notified by a third-party that a program may have redirected traffic to a malicious domain. Which Falcon page will assist you in searching for any domain request information related to this notice?

Falcon X

Investigate

Discover

Spotlight

QUESTION 37
When you configure and apply an IOA exclusion, what impact does it have on the host and what you see in the console?

The process specified is not sent to the Falcon Sandbox for analysis

The associated detection will be suppressed and the associated process would have been allowed to run

The sensor will stop sending events from the process specified in the regex pattern

The associated IOA will still generate a detection but the associated process would have been allowed to run

QUESTION 38
A list of managed and unmanaged neighbors for an endpoint can be found:

by using Hosts page in the Investigate tool

by reviewing “Groups” in Host Management under the Hosts page

under “Audit” by running Sensor Visibility Exclusions Audit

only by searching event data using Event Search

QUESTION 39
How long are quarantined files stored on the host?

45 Days

30 Days

Quarantined files are never deleted from the host

90 Days

QUESTION 40
What do IOA exclusions help you achieve?

Reduce false positives based on Next-Gen Antivirus settings in the Prevention Policy

Reduce false positives of behavioral detections from IOA based detections only

Reduce false positives of behavioral detections from IOA based detections based on a file hash

Reduce false positives of behavioral detections from Custom IOA and OverWatch detections only

QUESTION 41
The function of Machine Learning Exclusions is to___________.

stop all detections for a specific pattern ID

stop all sensor data collection for the matching path(s)

Stop all Machine Learning Preventions but a detection will still be generated and files will still be uploaded to the CrowdStrike Cloud

stop all ML-based detections and preventions for the matching path(s) and/or stop files from being uploaded to the CrowdStrike Cloud

QUESTION 42
You receive an email from a third-party vendor that one of their services is compromised,thevendor names a specific IP address that the compromised service was using. Where would you input this indicator to find any activity related to this IP address?

IP Addresses

Remote or Network Logon Activity

Remote Access Graph

Hash Executions