[Q32-Q46] The CCFR-201 PDF Dumps Greatest for the CrowdStrike Exam Study Guide!

Rate this post

The CCFR-201 PDF Dumps Greatest for the CrowdStrike Exam Study Guide!

Read Online CCFR-201 Test Practice Test Questions Exam Dumps

NO.32 What is the difference between a Host Search and a Host Timeline?

Results from a Host Search return information in an organized view by type, while a Host Timeline returns a view of all events recorded by the sensor

A Host Timeline only includes process execution events and user account activity

Results from a Host Timeline include process executions and related events organized by data type. A Host Search returns a temporal view of all events for the given host

There is no difference – Host Search and Host Timeline are different names for the same search page

Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Host Search allows you to search for hosts based on various criteria, such as hostname, IP address, OS, etc1. The results are displayed in an organized view by type, such as detections, incidents, processes, network connections, etc1. The Host Timeline allows you to view all events recorded by the sensor for a given host in a chronological order1. The events include process executions, file writes, registry modifications, network connections, user logins, etc1.

NO.33 The Falcon platform will show a maximum of how many detections per day for a single Agent Identifier (AID)?

500

750

1000

1200

Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, the Falcon platform will show a maximum of 1000 detections per day for a single AID1. This is a limitimposed by the Falcon API, which is used to retrieve the detections from the CrowdStrike Cloud1. If there are more than 1000 detections per day for a single AID, only the first 1000 will be shown1.

NO.34 What are Event Actions?

Automated searches that can be used to pivot between related events and searches

Pivotable hyperlinks available in a Host Search

Custom event data queries bookmarked by the currently signed in Falcon user

Raw Falcon event data

Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, Event Actions are automated searches that can be used to pivot between related events and searches1. They are available in various tools, such as Event Search, Process Timeline, Host Timeline, etc1. You can select one or more events and perform various actions, such as show a process timeline, show a host timeline, show associated event data, show a +/- 10-minute window of events, etc1. These actions can help you investigate and analyze events more efficiently and effectively1.

NO.35 What happens when you create a Sensor Visibility Exclusion for a trusted file path?

It excludes host information from Detections and Incidents generated within that file path location

It prevents file uploads to the CrowdStrike cloud from that file path

It excludes sensor monitoring and event collection for the trusted file path

It disables detection generation from that path, however the sensor can still perform prevention actions

Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, Sensor Visibility Exclusions allow you to exclude certain files or directories from being monitored by the CrowdStrike sensor, which can reduce noise and improve performance2. This means that no events will be collected or sent to the CrowdStrike Cloud for those files or directories2.

NO.36 What happens when a hash is set to Always Block through IOC Management?

Execution is prevented on all hosts by default

Execution is prevented on selected host groups

Execution is prevented and detection alerts are suppressed

The hash is submitted for approval to be blocked from execution once confirmed by Falcon specialists

Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, IOC Management allows you to manage indicators of compromise (IOCs), which are artifacts such as hashes, IP addresses, or domains that are associated with malicious activities2. You can set different actions for IOCs, such as Allow, No Action, or Always Block2. When you set a hash to Always Block through IOC Management, you are preventing that file from executing on any host in your organization by default2. This action also generates a detection alert when the file is blocked2.

NO.37 The Bulk Domain Search tool contains Domain information along with which of the following?

Process Information

Port Information

IP Lookup Information

Threat Actor Information

Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Bulk Domain Search tool allows you to search for one or more domains and view a summary of information from Falcon events that contain those domains1. The summary includes the domain name, IP address, country, city, ISP, ASN, geolocation, hostname, sensor ID, OS, process name, command line, and organizational unit of the host that communicated with those domains1. This means that the tool contains domain information along with IP lookup information1.

NO.38 Which is TRUE regarding a file released from quarantine?

It is allowed to execute on all hosts

It is deleted

No executions are allowed for 14 days after release

It will not generate future machine learning detections on the associated host

Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, when you release a file from quarantine, you are restoring it to its original location and allowing it to execute on any host in your organization2. This action also removes the file from the quarantine list and deletes it from the CrowdStrike Cloud2.

NO.39 Which statement is TRUE regarding the “Bulk Domains” search?

It will show a list of computers and process that performed a lookup of any of the domains in your search

The “Bulk Domains” search will allow you to blocklist your queried domains

The “Bulk Domains” search will show IP address and port information for any associated connectionsD.You should only pivot to the “Bulk Domains” search tool after completing an investigation

Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Bulk Domain Search tool allows you to search for one or more domains and view a summary of information from Falcon events that contain those domains2. The summary includes the hostname, sensor ID, OS, country, city, ISP, ASN, geolocation, process name, command line, and organizational unit of the host that performed a lookup of any of the domains in your search2. This can help you identify potential threats or vulnerabilities in your network2.

NO.40 What is the difference between Managed and Unmanaged Neighbors in the Falcon console?

A managed neighbor is currently network contained and an unmanaged neighbor is uncontained

A managed neighbor has an installed and provisioned sensor

An unmanaged neighbor is in a segmented area of the network

A managed sensor has an active prevention policy

Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, you can use the Hosts page in the Investigate tool to view information about your endpoints, such as hostname, IP address, OS, sensor version, etc2. You can also see a list of managed and unmanaged neighbors for each endpoint, which are other devices that have communicated with that endpoint over the network2. A managed neighbor is a device that has an installed and provisioned sensor that reports to the CrowdStrike Cloud2. An unmanaged neighbor is a device that does not have an installed or provisioned sensor2.

NO.41 Where are quarantined files stored on Windows hosts?

WindowsQuarantine

WindowsSystem32DriversCrowdStrikeQuarantine

WindowsSystem32

WindowstempDriversCrowdStrikeQuarantine

Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, when you quarantine a file from a host using IOC Management or Real Time Response (RTR), you are moving it from its original location to a secure location on the host where it cannot be executed2. The file is also encrypted and renamed with a random string of characters2. On Windows hosts, quarantined files are stored in C:\Windows\System32\Drivers\CrowdStrike\Quarantine folder2.

NO.42 The Process Activity View provides a rows-and-columns style view of the events generated in a detection.
Why might this be helpful?

The Process Activity View creates a consolidated view of all detection events for that process that can be exported for further analysis

The Process Activity View will show the Detection time of the earliest recorded activity which might indicate first affected machine

The Process Activity View only creates a summary of Dynamic Link Libraries (DLLs) loaded by a process

The Process Activity View creates a count of event types only, which can be useful when scoping the event

Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Process Activity View allows you to view all events generated by a process involved in a detection in a rows-and-columns style view1. This can be helpful because it creates a consolidated view of all detection events for that process that can be exported for further analysis1. You can also sort, filter, and pivot on the events by various fields, such as event type, timestamp, file name, registry key, network destination, etc1.

NO.43 You notice that taskeng.exe is one of the processes involved in a detection. What activity should you investigate next?

User logons after the detection

Executions of schtasks.exe after the detection

Scheduled tasks registered prior to the detection

Pivot to a Hash search for taskeng.exe

Explanation
According to the [Microsoft website], taskeng.exe is a legitimate Windows process that is responsible for running scheduled tasks. However, some malware may use this process or create a fake one to execute malicious code. Therefore, if you notice taskeng.exe involved in a detection, you should investigate whether there are any scheduled tasks registered prior to the detection that may have triggered or injected into taskeng.exe. You can use tools such as schtasks.exe or Task Scheduler to view or manage scheduled tasks.

NO.44 You are notified by a third-party that a program may have redirected traffic to a malicious domain. Which Falcon page will assist you in searching for any domain request information related to this notice?

Falcon X

Investigate

Discover

Spotlight

Explanation
According to the [CrowdStrike website], the Investigate page is where you can search for and analyze various types of data collected by the Falcon platform, such as events, hosts, processes, hashes, domains, IPs, etc1. You can use various tools, such as Event Search, Host Search, Process Timeline, Hash Search, Bulk Domain Search, etc., to perform different types of searches and view the results in different ways1. If you want to search for any domain request information related to a notice from a third-party, you can use the Investigate page to do so1. For example, you can use the Bulk Domain Search tool to search for the malicious domain and see which hosts and processes communicated with it1. You can also use the Event Search tool to search for DNSRequest events that contain the malicious domain and see more details about the query and response1.

NO.45 Aside from a Process Timeline or Event Search, how do you export process event data from a detection in
.CSV format?

You can’t export detailed event data from a detection, you have to use the Process Timeline or an Event Search

In Full Detection Details, you expand the nodes of the process tree you wish to expand and then click the “Export Process Events” button

In Full Detection Details, you choose the “View Process Activity” option and then export from that view

From the Detections Dashboard, you right-click the event type you wish to export and choose CSV.JSON or XML

Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, there are three ways to export process event data from a detection in .CSV format1:
You can use the Process Timeline tool and click on “Export CSV” button at the top right corner1.
You can use the Event Search tool and select one or more events and click on “Export CSV” button at the top right corner1.
You can use the Full Detection Details tool and choose the “View Process Activity” option from any process node in the process tree view1. This will show you all events generated bythat process in a rows-and-columns style view1. You can then click on “Export CSV” button at the top right corner1.

NO.46 Which Executive Summary dashboard item indicates sensors running with unsupported versions?

Detections by Severity

Inactive Sensors

Sensors in RFM

Active Sensors

Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Executive Summary dashboard provides an overview of your sensor health and activity1. It includes various items, such as Active Sensors, Inactive Sensors, Detections by Severity, etc1. The item that indicates sensors running with unsupported versions is Sensors in RFM (Reduced Functionality Mode)1. RFM is a state where a sensor has limited functionality due to various reasons, such as license expiration, network issues, tampering attempts, or unsupported versions1. You can see the number and percentage of sensors in RFM and the reasons why they are in RFM1.

Loading …