Latest CCFR-201 Dumps (V9.03) – Practice Real Dumps Questions to Prepare for the CrowdStrike Certified Falcon Responder (CCFR) Certification

1. After pivoting to an event search from a detection, you locate the ProcessRollup2 event.

Which two field values are you required to obtain to perform a Process Timeline search so you can determine what the process was doing?

2. The function of Machine Learning Exclusions is to___________.

3. What happens when you create a Sensor Visibility Exclusion for a trusted file path?

4. What types of events are returned by a Process Timeline?

5. What is the difference between a Host Search and a Host Timeline?

6. When examining raw event data, what is the purpose of the field called ParentProcessld_decimal?

7. What action is used when you want to save a prevention hash for later use?

8. A list of managed and unmanaged neighbors for an endpoint can be found:

9. What happens when a hash is allowlisted?

10. Which of the following is returned from the IP Search tool?

11. Which is TRUE regarding a file released from quarantine?

12. Which of the following is an example of a MITRE ATT&CK tactic?

13. You notice that taskeng.exe is one of the processes involved in a detection.

What activity should you investigate next?

14. Where can you find hosts that are in Reduced Functionality Mode?

15. From the Detections page, how can you view 'in-progress' detections assigned to Falcon Analyst Alex?

16. The Process Activity View provides a rows-and-columns style view of the events generated in a detection.

Why might this be helpful?

17. After running an Event Search, you can select many Event Actions depending on your results.

Which of the following is NOT an option for any Event Action?

18. Which option indicates a hash is allowlisted?

19. Which of the following tactic and technique combinations is sourced from MITRE ATT&CK information?

20. What do IOA exclusions help you achieve?