Updated Aug-2024 Exam CCFR-201 Dumps - Pass Your Certification Exam [Q28-Q50]

Rate this post

Updated Aug-2024 Exam CCFR-201 Dumps – Pass Your Certification Exam

Latest Real CrowdStrike CCFR-201 Exam Dumps Questions

NO.28 The Bulk Domain Search tool contains Domain information along with which of the following?

Process Information

Port Information

IP Lookup Information

Threat Actor Information

NO.29 What are Event Actions?

Automated searches that can be used to pivot between related events and searches

Pivotable hyperlinks available in a Host Search

Custom event data queries bookmarked by the currently signed in Falcon user

Raw Falcon event data

NO.30 When you configure and apply an IOA exclusion, what impact does it have on the host and what you see in the console?

The process specified is not sent to the Falcon Sandbox for analysis

The associated detection will be suppressed and the associated process would have been allowed to run

The sensor will stop sending events from the process specified in the regex pattern

The associated IOA will still generate a detection but the associated process would have been allowed to run

NO.31 What types of events are returned by a Process Timeline?

Only detection events

All cloudable events

Only process events

Only network events

NO.32 What action is used when you want to save a prevention hash for later use?

Always Allow

Never Block

No Action

Always Block

NO.33 After pivoting to an event search from a detection, you locate the ProcessRollup2 event. Which two field values are you required to obtain to perform a Process Timeline search so you can determine what the process was doing?

SHA256 and TargetProcessld_decimal

SHA256 and ParentProcessld_decimal

aid and ParentProcessld_decimal

aid and TargetProcessld_decimal

NO.34 When looking at the details of a detection, there are two fields called Global Prevalence and Local Prevalence.
Which answer best defines Local Prevalence?

Local prevalence is the frequency with which the hash of the triggering file is seen across the entire Internet

Local Prevalence tells you how common the hash of the triggering file is within your environment (CID)

Local Prevalence is the Virus Total score for the hash of the triggering file

Local prevalence is the frequency with which the hash of the triggering file is seen across all CrowdStrike customer environments

NO.35 The function of Machine Learning Exclusions is to___________.

stop all detections for a specific pattern ID

stop all sensor data collection for the matching path(s)

Stop all Machine Learning Preventions but a detection will still be generated and files will still be uploaded to the CrowdStrike Cloud

stop all ML-based detections and preventions for the matching path(s) and/or stop files from being uploaded to the CrowdStrike Cloud

NO.36 In the Hash Search tool, which of the following is listed under Process Executions?

Operating System

File Signature

Command Line

Sensor Version

NO.37 You are notified by a third-party that a program may have redirected traffic to a malicious domain. Which Falcon page will assist you in searching for any domain request information related to this notice?

Falcon X

Investigate

Discover

Spotlight

NO.38 The Process Activity View provides a rows-and-columns style view of the events generated in a detection.
Why might this be helpful?

The Process Activity View creates a consolidated view of all detection events for that process that can be exported for further analysis

The Process Activity View will show the Detection time of the earliest recorded activity which might indicate first affected machine

The Process Activity View only creates a summary of Dynamic Link Libraries (DLLs) loaded by a process

The Process Activity View creates a count of event types only, which can be useful when scoping the event

NO.39 How long does detection data remain in the CrowdStrike Cloud before purging begins?

90 Days

45 Days

30 Days

14 Days

NO.40 Where are quarantined files stored on Windows hosts?

WindowsQuarantine

WindowsSystem32DriversCrowdStrikeQuarantine

WindowsSystem32

WindowstempDriversCrowdStrikeQuarantine

NO.41 Which is TRUE regarding a file released from quarantine?

No executions are allowed for 14 days after release

It is allowed to execute on all hosts

It is deleted

It will not generate future machine learning detections on the associated host

NO.42 The Falcon platform will show a maximum of how many detections per day for a single Agent Identifier (AID)?

500

750

1000

1200

NO.43 What action is used when you want to save a prevention hash for later use?

Always Block

Never Block

Always Allow

No Action

NO.44 From a detection, what is the fastest way to see children and sibling process information?

Select the Event Search option. Then from the Event Actions, select Show Associated Event Data (From TargetProcessld_decimal)

Select Full Detection Details from the detection

Right-click the process and select “Follow Process Chain”

Select the Process Timeline feature, enter the AID. Target Process ID, and Parent Process ID

NO.45 What happens when you create a Sensor Visibility Exclusion for a trusted file path?

It excludes host information from Detections and Incidents generated within that file path location

It prevents file uploads to the CrowdStrike cloud from that file path

It excludes sensor monitoring and event collection for the trusted file path

It disables detection generation from that path, however the sensor can still perform prevention actions

NO.46 Which option indicates a hash is allowlisted?

No Action

Allow

Ignore

Always Block

NO.47 What information is contained within a Process Timeline?

All cloudable process-related events within a given timeframe

All cloudable events for a specific host

Only detection process-related events within a given timeframe

A view of activities on Mac or Linux hosts

NO.48 What happens when a hash is allowlisted?

Execution is prevented, but detection alerts are suppressed

Execution is allowed on all hosts, including all other Falcon customers

The hash is submitted for approval to be allowed to execute once confirmed by Falcon specialists

Execution is allowed on all hosts that fall under the organization’s CID

NO.49 Which is TRUE regarding a file released from quarantine?

It is allowed to execute on all hosts

It is deleted

No executions are allowed for 14 days after release

It will not generate future machine learning detections on the associated host

NO.50 Which statement is TRUE regarding the “Bulk Domains” search?

It will show a list of computers and process that performed a lookup of any of the domains in your search

The “Bulk Domains” search will allow you to blocklist your queried domains

The “Bulk Domains” search will show IP address and port information for any associated connectionsD.You should only pivot to the “Bulk Domains” search tool after completing an investigation