CrowdStrike Exam CCFR-201 Topic 2 Question 22 Discussion

Actual exam question for CrowdStrike's CCFR-201 exam

Question #: 22
Topic #: 2

From a detection, what is the fastest way to see children and sibling process information?

ASelect the Event Search option. Then from the Event Actions, select Show Associated Event Data (From TargetProcessld_decimal)

BSelect Full Detection Details from the detection

CRight-click the process and select 'Follow Process Chain'

DSelect the Process Timeline feature, enter the AID. Target Process ID, and Parent Process ID

Show Suggested Answer

Suggested Answer: B

According to theCrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, Global Prevalence and Local Prevalence are two fields that provide information about how common or rare a file is based on its hash value2.Global Prevalence tells you how frequently the hash of the triggering file is seen across all CrowdStrike customer environments2.Local Prevalence tells you how frequently the hash of the triggering file is seen within your environment (CID)2.These fields can help you assess the risk and impact of a detection2.

by King at Sep 08, 2024, 09:32 AM

Limited Time Offer

25%

Off

Get Premium CCFR-201 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Tenesha

4 days ago

I'm going with option B. Full Detection Details. It's straightforward and I don't have to worry about missing anything important.

upvoted 0 times

...

Yolando

8 days ago

Right-clicking the process and selecting 'Follow Process Chain' seems like the easiest way to me. I don't want to have to mess around with too many menus and options.

upvoted 0 times

...

Loise

14 days ago

Hmm, I'm not sure. The Process Timeline feature sounds interesting, but I'm worried it might be a bit too complicated for a quick lookup. I'll have to think this one through.

upvoted 0 times

...

Merilyn

16 days ago

I prefer to use the Process Timeline feature and enter the IDs. It gives a more detailed view of the process chain.

upvoted 0 times

...

I think the fastest way is to select the Event Search option and then choose Show Associated Event Data (From TargetProcessld_decimal). It seems like the most direct approach to get the child and sibling process info.

upvoted 0 times

...

Shenika

19 days ago

I agree with Carole, that seems like the most efficient way to see children and sibling process information.

upvoted 0 times

...

Carole

25 days ago

I think the fastest way is to select the Event Search option and then Show Associated Event Data.

upvoted 0 times

...

CrowdStrike Exam CCFR-201 Topic 2 Question 22 Discussion

Contribute your Thoughts:

Tenesha

Yolando

Loise

Merilyn

Jutta

Shenika

Carole