CrowdStrike CCFR-201b Exam Questions Free Practice Test

Viewing page 6 out of 6 pages

Viewing questions 51-60 out of questions

Questions # 51:

A responder decides to set a specific Custom IOA to the ' Monitor ' action. Which of the following sentences best describes the technical result of this choice?

Options:

The sensor will block the activity and alert the user with a pop-up.

The sensor will create detections with ' Informational ' severity but will not block the activity.

The sensor will log the activity in the audit logs but will not generate a detection.

The sensor will automatically isolate the host from the network.

Expert Solution

Questions # 52:

Multiple detections with the process schtasks.exe begin to alert in the UI. The process executes the following command line on several unique hosts:

schtasks.exe /Query /TN " Qljsscdqr "

What is the most efficient way to identify which hosts are executing this scheduled task?

Options:

Filter detections by command line and sort by ' Host:A to Z '

Filter detections by command line and group by triggering file

Filter detections by the triggering file and sort by ' Host:A to Z '

Filter detections by command line and group by host

Expert Solution

Questions # 53:

Which of the following statements about the ' Hash Search ' (Single Search) is TRUE?

Options:

It can search for both files and registry keys simultaneously.

It identifies the geographical location of the file ' s creator.

The ' Hash Written History ' section is only available for SHA256 hashes.

It is primarily used to isolate a host from the network.

Expert Solution

Questions # 54:

The ' Detection Resolutions ' dashboard helps track team performance. Which of the following CANNOT be seen from this dashboard?

Options:

Average time to resolve a detection.

Total number of detections resolved by each analyst.

The top 10 hosts/users/files with the most detections.

The breakdown of True Positive vs. False Positive resolutions.

Expert Solution

Questions # 55:

Bulk Search tools have several features in common. Which of the following is incorrect as a feature common to all Bulk Search types?

Options:

They allow for searching multiple items (up to 500) at once.

Regular Expressions (Regex) are allowed within the search fields.

Search results can be exported for further analysis.

They search across historical telemetry in the cloud.

Expert Solution

Questions # 56:

Which of the following is NOT a valid event type?

Options:

StartofProcess

EndofProcess

ProcessRollup2

DnsRequest

Expert Solution

Questions # 57:

The Falcon sensor can take several automated actions to protect an endpoint. Which of the following is NOT an action that Falcon takes upon detection?

Options:

Process Termination

File Quarantine

Process Restart

Network Isolation

Expert Solution

Questions # 58:

By default, when a file is quarantined by the Falcon sensor to prevent execution, how many days does that file remain on the host ' s local disk?

Options:

7 days

14 days

30 days

90 days

Expert Solution

Questions # 59:

What happens when a hash is allowlisted?

Options:

Execution is prevented, but detection alerts are suppressed

Execution is allowed on all hosts, including all other Falcon customers

The hash is submitted for approval to be allowed to execute once confirmed by Falcon specialists

Execution is allowed on all hosts that fall under the organization ' s CID

Expert Solution

Viewing page 6 out of 6 pages

Viewing questions 51-60 out of questions

Summer Certification Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: force70

Pass the CrowdStrike CCFR CCFR-201b Questions and answers with CertsForce