Best CCFR-201 Exam Dumps for the Preparation of Latest Exam Questions [Q31-Q50]

12 Jan, 2024 By admin CCFR-201, CrowdStrike 0 Comments

Best CCFR-201 Exam Dumps for the Preparation of Latest Exam Questions [Q31-Q50]

Rate this post

Best CCFR-201 Exam Dumps for the Preparation of Latest Exam Questions

CCFR-201 Actual Questions 100% Same Braindumps with Actual Exam!

NO.31 What are Event Actions?

Automated searches that can be used to pivot between related events and searches

Pivotable hyperlinks available in a Host Search

Custom event data queries bookmarked by the currently signed in Falcon user

Raw Falcon event data

NO.32 How long does detection data remain in the CrowdStrike Cloud before purging begins?

90 Days

45 Days

14 Days

30 Days

NO.33 What action is used when you want to save a prevention hash for later use?

Always Block

Never Block

Always Allow

No Action

NO.34 Which statement is TRUE regarding the “Bulk Domains” search?

It will show a list of computers and process that performed a lookup of any of the domains in your search

The “Bulk Domains” search will allow you to blocklist your queried domains

The “Bulk Domains” search will show IP address and port information for any associated connectionsD.You should only pivot to the “Bulk Domains” search tool after completing an investigation

NO.35 What information does the MITRE ATT&CKFramework provide?

It provides best practices for different cybersecurity domains, such as Identify and Access Management

It provides a step-by-step cyber incident response strategy

It provides the phases of an adversary’s lifecycle, the platforms they are known to attack, and the specific methods they use

It is a system that attributes an attack techniques to a specific threat actor

NO.36 How long does detection data remain in the CrowdStrike Cloud before purging begins?

90 Days

45 Days

30 Days

14 Days

NO.37 What happens when you open the full detection details?

Theprocess explorer opens and the detection is removed from the console

The process explorer opens and you’re able to view the processes and process relationships

The process explorer opens and the detection copies to the clipboard

The process explorer opens and the Event Search query is run for the detection

NO.38 When reviewing a Host Timeline, which of the following filters is available?

Severity

Event Types

User Name

Detection ID

NO.39 How long are quarantined files stored on the host?

45 Days

30 Days

Quarantined files are never deleted from the host

90 Days

NO.40 The function of Machine Learning Exclusions is to___________.

stop all detections for a specific pattern ID

stop all sensor data collection for the matching path(s)

Stop all Machine Learning Preventions but a detection will still be generated and files will still be uploaded to the CrowdStrike Cloud

stop all ML-based detections and preventions for the matching path(s) and/or stop files from being uploaded to the CrowdStrike Cloud

NO.41 How are processes on the same plane ordered (bottom ‘VMTOOLSD.EXE’ to top CMD.EXE’)?

Process ID (Descending, highest on bottom)

Time started (Descending, most recent on bottom)

Time started (Ascending, most recent on top)

Process ID (Ascending, highest on top)

NO.42 Which of the following is NOT a filter available on the Detections page?

Severity

CrowdScore

Time

Triggering File

NO.43 What does the Full Detection Details option provide?

It provides a visualization of program ancestry via the Process Tree View

It provides a visualization of program ancestry via the Process Activity View

It provides detailed list of detection events via the Process Table View

It provides a detailed list of detection events via the Process Tree View

NO.44 When looking at the details of a detection, there are two fields called Global Prevalence and Local Prevalence.
Which answer best defines Local Prevalence?

Local prevalence is the frequency with which the hash of the triggering file is seen across the entire Internet

Local Prevalence tells you how common the hash of the triggering file is within your environment (CID)

Local Prevalence is the Virus Total score for the hash of the triggering file

Local prevalence is the frequency with which the hash of the triggering file is seen across all CrowdStrike customer environments

NO.45 How long are quarantined files stored in the CrowdStrike Cloud?

45 Days

90 Days

Days

Quarantined files are not deleted

NO.46 The Falcon platform will show a maximum of how many detections per day for a single Agent Identifier (AID)?

500

750

1000

1200

NO.47 When you configure and apply an IOA exclusion, what impact does it have on the host and what you see in the console?

The process specified is not sent to the Falcon Sandbox for analysis

The associated detection will be suppressed and the associated process would have been allowed to run

The sensor will stop sending events from the process specified in the regex pattern

The associated IOA will still generate a detection but the associated process would have been allowed to run

NO.48 What is the difference between a Host Search and a Host Timeline?

Results from a Host Search return information in an organized view by type, while a Host Timeline returns a view of all events recorded by the sensor

A Host Timeline only includes process execution events and user account activity

Results from a Host Timeline include process executions and related events organized by data type. A Host Search returns a temporal view of all events for the given host

There is no difference – Host Search and Host Timeline are different names for the same search page

NO.49 What is an advantage of using the IP Search tool?

IP searches provide manufacture and timezone data that can not be accessed anywhere else

IP searches allow for multiple comma separated IPv6 addresses as input

IP searches offer shortcuts to launch response actions and network containment on target hosts

IP searches provide host, process, and organizational unit data without the need to write a query

NO.50 After running an Event Search, you can select many Event Actions depending on your results. Which of the following is NOT an option for any Event Action?

Draw Process Explorer

Show a +/- 10-minute window of events

Show a Process Timeline for the responsible process

Show Associated Event Data (from TargetProcessld_decimal or ContextProcessld_decimal)