CrowdStrike CCFR-201b 考試大綱：

主題	簡介
主題 1	Event Search: This domain focuses on performing advanced event searches from detections, refining searches using event actions, and distinguishing between commonly used event types.
主題 2	Event Investigation: This domain covers analyzing Process and Host Timelines, pivoting to Process Timeline or Process Explorer, and analyzing process relationships using Full Detection Details.
主題 3	Detection Analysis: This domain covers analyzing and triaging detections in Falcon, including interpreting dashboards, endpoint detections, contextual data, process views, prevalence, IOCs, and implementing hash management actions like blocking, allowlisting, and exclusions.
主題 4	ATT&CK Frameworks: This domain covers understanding the MITRE ATT&CK framework and applying its tactics and techniques within Falcon to provide context to detections.
主題 5	Search Tools: This domain covers utilizing User Search, IP Search, Hash Search, Host Search, and Bulk Domain Search to gather intelligence during investigations.

參考：https://assets.crowdstrike.com/is/content/crowdstrikeinc/CCFR_CertificationGuidepdf

CrowdStrike CCFR-201b 考試概覽:

認證廠商:	CrowdStrike
考試名稱:	CrowdStrike 認證 Falcon 應變專員 (CCFR-201b)
考試代碼:	CCFR-201b
相關認證:	CrowdStrike 認證 Falcon 管理員 CrowdStrike Falcon 情報分析師
支援語言:	English
考試形式:	實際事件應變任務（概念性）, 情境題, 選擇題
推薦課程:	CrowdStrike 大學培訓
考試報名:	CrowdStrike 認證入口網站
範例考題:	CrowdStrike CCFR-201b 範例考題
考試方式:	透過官方認證平台進行線上監考考試
必備條件:	建議具備端點安全概念的相關經驗，並基本熟悉 CrowdStrike Falcon 平台；推薦先取得相關基礎認證。
官方大綱網址:	https://www.crowdstrike.com/services/certification/

最新的 CrowdStrike CCFR CCFR-201b 免費考試真題：

問題 #1

To manage the lifecycle of security incidents and review new alerts, a responder must navigate through the Falcon sidebar to which specific location?

A. Investigate > Host Search > Alerts
B. Endpoint Security > Monitor > Endpoint Detections
C. Configuration > Security Policies > Detections
D. Dashboards > Global Activity > Security Alerts

顯示解答討論 0

答案：B 🗳️

問題 #2

A responder is focused on a specific malicious script and wants to see everything that the script ' s process did. Which timeline is the best tool for this task?