CrowdStrike Exam CCFR-201 Topic 1 Question 16 Discussion

Actual exam question for CrowdStrike's CCFR-201 exam

Question #: 16
Topic #: 1

Within the MITRE-Based Falcon Detections Framework, what is the correct way to interpret Keep Access > Persistence > Create Account?

AAn adversary is trying to keep access through persistence by creating an account

BAn adversary is trying to keep access through persistence using browser extensions

CAn adversary is trying to keep access through persistence using external remote services

Dadversary is trying to keep access through persistence using application skimming

Show Suggested Answer

Suggested Answer: B

According to theCrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, when you quarantine a file from a host using IOC Management or Real Time Response (RTR), you are moving it from its original location to a secure location on the host where it cannot be executed2.The file is also encrypted and renamed with a random string of characters2.On Windows hosts, quarantined files are stored in C:WindowsSystem32DriversCrowdStrikeQuarantine folder2.

by Justine at Jun 21, 2024, 06:01 PM

Limited Time Offer

25%

Off

Get Premium CCFR-201 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Georgene

7 days ago

Well, at least the adversary is being polite and 'keeping access' rather than just barging in. Gotta love those courteous hackers!

upvoted 0 times

...

Kris

9 days ago

Hmm, 'application skimming' doesn't really fit the description. I'd say A is the way to go on this one.

upvoted 0 times

...

Julio

14 days ago

C seems plausible, but the question specifically mentions 'Create Account', so I believe A is the right answer here.

upvoted 0 times

...

Laura

15 days ago

I don't think B is correct. Browser extensions are not the same as creating an account for persistence.

upvoted 0 times

Cammy

4 days ago

A) An adversary is trying to keep access through persistence by creating an account

upvoted 0 times

...

Ludivina

16 days ago

I'm not sure, but I think option C could also be a possibility since external remote services can also help with persistence.

upvoted 0 times

...

The correct answer is A. The MITRE-Based Falcon Detections Framework clearly indicates that 'Keep Access > Persistence > Create Account' means the adversary is trying to maintain their access through persistence by creating an account.

upvoted 0 times

...

Celestina

18 days ago

I agree with Mee, option A makes sense because creating an account can help the adversary maintain access.

upvoted 0 times

...

Mee

21 days ago

I think the correct way to interpret Keep Access > Persistence > Create Account is option A.

upvoted 0 times

...

CrowdStrike Exam CCFR-201 Topic 1 Question 16 Discussion

Contribute your Thoughts:

Georgene

Kris

Julio

Laura

Cammy

Ludivina

Coral

Celestina

Mee