CrowdStrike Exam CCFR-201 Topic 2 Question 22 Discussion

Actual exam question for CrowdStrike's CCFR-201 exam

Question #: 22
Topic #: 2

From a detection, what is the fastest way to see children and sibling process information?

ASelect the Event Search option. Then from the Event Actions, select Show Associated Event Data (From TargetProcessld_decimal)

BSelect Full Detection Details from the detection

CRight-click the process and select 'Follow Process Chain'

DSelect the Process Timeline feature, enter the AID. Target Process ID, and Parent Process ID

Show Suggested Answer

Suggested Answer: B

According to theCrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, Global Prevalence and Local Prevalence are two fields that provide information about how common or rare a file is based on its hash value2.Global Prevalence tells you how frequently the hash of the triggering file is seen across all CrowdStrike customer environments2.Local Prevalence tells you how frequently the hash of the triggering file is seen within your environment (CID)2.These fields can help you assess the risk and impact of a detection2.

by King at Sep 08, 2024, 09:32 AM

Limited Time Offer

25%

Off

Get Premium CCFR-201 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Vivan

2 months ago

I'm just going to start randomly clicking things until I find the answer. That's how I passed my driver's test, after all!

upvoted 0 times

Ligia

18 days ago

Broderick: Let me know if you need any help navigating through the process.

upvoted 0 times

...

Broderick

19 days ago

User 2: Good idea! I'll give that a try.

upvoted 0 times

...

Whitney

24 days ago

User 1: Don't just randomly click things, try selecting the Event Search option and then Show Associated Event Data.

upvoted 0 times

...

Tenesha

2 months ago

I'm going with option B. Full Detection Details. It's straightforward and I don't have to worry about missing anything important.

upvoted 0 times

Frederica

17 days ago

I agree with option D. Using the Process Timeline feature with the specific IDs is efficient for tracking children and sibling processes.

upvoted 0 times

...

Stefania

1 months ago

I think option A is the fastest. Select Event Search and then Show Associated Event Data. It provides a quick overview of children and sibling processes.

upvoted 0 times

...

Geoffrey

1 months ago

I prefer option C. Right-click the process and select 'Follow Process Chain'. It gives a clear view of the sibling processes.

upvoted 0 times

...

Olen

1 months ago

I'm going with option B. Full Detection Details. It's straightforward and I don't have to worry about missing anything important.

upvoted 0 times

...

Yolando

2 months ago

Right-clicking the process and selecting 'Follow Process Chain' seems like the easiest way to me. I don't want to have to mess around with too many menus and options.

upvoted 0 times

Ryan

1 months ago

User 2: I prefer using the Process Timeline feature to enter the IDs and get the details. It's more precise for me.

upvoted 0 times

...

Alaine

1 months ago

User 1: I agree, 'Follow Process Chain' is the quickest way to see children and sibling process information.

upvoted 0 times

...

Loise

2 months ago

Hmm, I'm not sure. The Process Timeline feature sounds interesting, but I'm worried it might be a bit too complicated for a quick lookup. I'll have to think this one through.

upvoted 0 times

...

Merilyn

2 months ago

I prefer to use the Process Timeline feature and enter the IDs. It gives a more detailed view of the process chain.

upvoted 0 times

...

I think the fastest way is to select the Event Search option and then choose Show Associated Event Data (From TargetProcessld_decimal). It seems like the most direct approach to get the child and sibling process info.

upvoted 0 times

Justine

2 months ago

D) Select the Process Timeline feature, enter the AID. Target Process ID, and Parent Process ID

upvoted 0 times

...

Slyvia

2 months ago

A) Select the Event Search option. Then from the Event Actions, select Show Associated Event Data (From TargetProcessld_decimal)

upvoted 0 times

...

Linn

2 months ago

C) Right-click the process and select 'Follow Process Chain'

upvoted 0 times

...

Noe

2 months ago

A) Select the Event Search option. Then from the Event Actions, select Show Associated Event Data (From TargetProcessld_decimal)

upvoted 0 times

...

Shenika

2 months ago

I agree with Carole, that seems like the most efficient way to see children and sibling process information.

upvoted 0 times

...

Carole

3 months ago

I think the fastest way is to select the Event Search option and then Show Associated Event Data.

upvoted 0 times

...

CrowdStrike Exam CCFR-201 Topic 2 Question 22 Discussion

Contribute your Thoughts:

Vivan

Ligia

Broderick

Whitney

Tenesha

Frederica

Stefania

Geoffrey

Olen

Yolando

Ryan

Alaine

Loise

Merilyn

Jutta

Justine

Slyvia

Linn

Noe

Shenika

Carole