Name: CrowdStrike CCFR-201 Exam
Brand: Pass4Success
SKU: CCFR-201
Price: 69.00 USD
Availability: InStock
Rating: 4.9 (22 reviews)

Disscuss CrowdStrike CCFR-201 Topics, Questions or Ask Anything Related

Submit Cancel

Currently there are no comments in this discussion, be the first to comment!

Free CrowdStrike CCFR-201 Exam Actual Questions

Note: Premium Questions for CCFR-201 were last updated On May. 10, 2024 (see below)

Question #1

When looking at the details of a detection, there are two fields called Global Prevalence and Local Prevalence. Which answer best defines Local Prevalence?

ALocal prevalence is the frequency with which the hash of the triggering file is seen across the entire Internet

BLocal Prevalence tells you how common the hash of the triggering file is within your environment (CID)

CLocal Prevalence is the Virus Total score for the hash of the triggering file

DLocal prevalence is the frequency with which the hash of the triggering file is seen across all CrowdStrike customer environments

Reveal Solution

Correct Answer: B

According to theCrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, Global Prevalence and Local Prevalence are two fields that provide information about how common or rare a file is based on its hash value2.Global Prevalence tells you how frequently the hash of the triggering file is seen across all CrowdStrike customer environments2.Local Prevalence tells you how frequently the hash of the triggering file is seen within your environment (CID)2.These fields can help you assess the risk and impact of a detection2.

Question #2

How does a DNSRequest event link to its responsible process?

AVia both its ContextProcessld__decimal and ParentProcessld_decimal fields

BVia its ParentProcessld_decimal field

CVia its ContextProcessld_decimal field

DVia its TargetProcessld_decimal field

Reveal Solution

Correct Answer: C

According to theCrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, a DNSRequest event contains information about a DNS query made by a process2.The event has several fields, such as DomainName, QueryType, QueryResponseCode, etc2.The field that links a DNSRequest event to its responsible process is ContextProcessId_decimal, which contains the decimal value of the process ID of the process that generated the event2.You can use this field to trace the process lineage and identify malicious or suspicious activities2.

Question #3

Where are quarantined files stored on Windows hosts?

AWindows\Quarantine

BWindows\System32\Drivers\CrowdStrike\Quarantine

CWindows\System32\

DWindows\temp\Drivers\CrowdStrike\Quarantine

Reveal Solution

Correct Answer: B

According to theCrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, when you quarantine a file from a host using IOC Management or Real Time Response (RTR), you are moving it from its original location to a secure location on the host where it cannot be executed2.The file is also encrypted and renamed with a random string of characters2.On Windows hosts, quarantined files are stored in C:\Windows\System32\Drivers\CrowdStrike\Quarantine folder2.

Question #4

Which Executive Summary dashboard item indicates sensors running with unsupported versions?

ADetections by Severity

BInactive Sensors

CSensors in RFM

DActive Sensors

Reveal Solution

Correct Answer: C

According to theCrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Executive Summary dashboard provides an overview of your sensor health and activity1.It includes various items, such as Active Sensors, Inactive Sensors, Detections by Severity, etc1.The item that indicates sensors running with unsupported versions is Sensors in RFM (Reduced Functionality Mode)1.RFM is a state where a sensor has limited functionality due to various reasons, such as license expiration, network issues, tampering attempts, or unsupported versions1.You can see the number and percentage of sensors in RFM and the reasons why they are in RFM1.

Question #5

Where are quarantined files stored on Windows hosts?

AWindows\Quarantine

BWindows\System32\Drivers\CrowdStrike\Quarantine

CWindows\System32\

DWindows\temp\Drivers\CrowdStrike\Quarantine

Reveal Solution

Correct Answer: B

Unlock Premium CCFR-201 Exam Questions with Advanced Practice Test Features:

Select Question Types you want
Set your Desired Pass Percentage
Allocate Time (Hours : Minutes)
Create Multiple Practice tests with Limited Questions
Customer Support

Get Full Access Now