最新的CrowdStrike CCFR認證 CCFR-201b考試題庫

問題1

A responder needs to find a specific sequence of network connections that did not trigger a detection. Which search tool allows them to search for anything within the raw telemetry?

A. Host Search

B. User Search

C. Hash Search

D. Event Search

正確答案: D

問題2

Which statement is TRUE regarding the " Bulk Domains " search?

A. It will show a list of computers and process that performed a lookup of any of the domains in your search

B. The " Bulk Domains " search will show IP address and port information for any associated connections

C. The " Bulk Domains " search will allow you to blocklist your queried domains

D. You should only pivot to the " Bulk Domains " search tool after completing an investigation

正確答案: A

問題3

Bulk Search tools have several features in common. Which of the following is incorrect as a feature common to all Bulk Search types?

A. They search across historical telemetry in the cloud.

B. Regular Expressions (Regex) are allowed within the search fields.

C. They allow for searching multiple items (up to 500) at once.

D. Search results can be exported for further analysis.

正確答案: B

問題4

When reviewing the data within a process timeline, what specific type of information is being displayed to the responder?

A. A capture of all raw network packets sent by the process.

B. All cloudable process-related events (files written, network connections, etc.) for that process in a given timeframe.

C. A summary of the hardware performance metrics during the time of the detection.

D. A list of every user who has ever logged into that specific endpoint.

正確答案: B

問題5

When training a new team member on how to interpret Falcon telemetry, a senior responder explains the definition of a ' Tactic ' . Which of the following sentences best captures the technical definition of a Tactic in this context?

A. It is the unique cryptographic hash associated with a malicious file discovered on disk.

B. It is the specific command-line string used to execute a PowerShell script.

C. It is the adversary ' s tactical goal: the fundamental reason for performing a specific action.

D. It represents the specific software version or exploit code used to crash a service.

正確答案: C

問題6

Which of the following is returned from the IP Search tool?

A. Unmanaged host data from system ARP tables for the given IP

B. IP Detection Summary information for detection events containing the given IP

C. IP Summary information from Falcon events containing the given IP

D. Threat Graph Data for the given IP from Falcon sensors

正確答案: C

問題7

The Falcon console is divided into several modules. Timelines (Host and Process) are technically a part of which Falcon page?

A. Configuration

B. Investigate

C. Activity

D. Dashboards

正確答案: B

問題8

An analyst needs to perform local sandbox analysis on a malicious file. When they download a quarantined file from the Falcon UI, what is the file format and the default password?

A. .exe, no password

B. .zip, password: crowdstrike

C. .rar, password: malware

D. .7-zip, password: infected

正確答案: D

問題9

The Falcon console integrates heavily with the MITRE ATT AND CK framework to provide industry- standard context. Which of the following tactics displayed in the detection UI is a direct implementation of a MITRE ATT AND CK tactic?

A. Impact

B. Malware Action

C. Script-Based Execution

D. Intelligence-Based Match

正確答案: A

問題10

What is the difference between a Host Search and a Host Timeline?

A. Results from a Host Search return information in an organized view by type, while a Host Timeline returns a view of all events recorded by the sensor

B. Results from a Host Timeline include process executions and related events organized by data type. A Host Search returns a temporal view of all events for the given host

C. There is no difference - Host Search and Host Timeline are different names for the same search page

D. A Host Timeline only includes process execution events and user account activity

正確答案: A

最新的CrowdStrike Certified Falcon Responder - CCFR-201b免費考試真題

最新更新

站內鏈接

聯系我們