Pass Your CCFR Certification Exam By Learning the CCFR-201b Dumps (V9.02): Continue to Read CCFR-201b Free Dumps (Part 2, Q41-Q80) Online

1. What does the "Initial Access" tactic include in the context of the MITRE ATT&CK® Framework?

2. During an event investigation, what does the term "indicator of compromise" (IOC) refer to?

3. Which role (with appropriate RTR permissions) is required to execute Real Time Response commands in Falcon?

4. In CrowdStrike Falcon, which type of search would you use to investigate unusual or anomalous user account activities?

5. When initiating an Event Search from a detection, what is the first step analysts typically perform?

6. What Falcon feature visually represents process relationships during a detection investigation?

7. In CrowdsStrike Falcon, what does the term "Event Search" primarily refer to?

8. Which of the following actions can be performed using Falcon RTR’s "Process Management" capability?

9. Which of the following is a primary use of the MITRE ATT&CK® Framework in incident response?

10. Which of the following use cases best justifies using the Bulk Domain Search tool?

11. When using the search tools in CrowdStrike Falcon, what is the maximum number of results that can typically be returned in a single query?

12. What is a common method to validate the effectiveness of Falcon detection rules?

13. When reviewing alerts in Falcon, what is the first step in the detection analysis process?

14. In the MITRE ATT&CK® Framework, which of the following techniques falls under the 'Execution' tactic?

15. Which function does the "Export" feature in Event Search provide?

16. What type of events can you search for using the Event Search feature in CrowdStrike Falcon?

17. Which two host actions are recommended after confirming a high-severity detection in Falcon? (Choose two)

18. From the Full Detection Details panel, the __________ can be used to identify which process launched the suspicious activity.

19. Which two Falcon features help visualize detections over time? (Choose two)

20. Which Falcon feature displays a process’s ancestors and descendants in a graphical format to understand the attack chain?

21. Which of the following is considered an indicator of compromise (IOC)?

22. When viewing detection information, which component provides granular details like command-line arguments and file paths?

23. What key details are revealed during a Hash Search? (Choose three)

24. Which Falcon capability provides managed threat hunting and analysis of recent security events?

25. What is a primary feature of the interactive command line in Falcon RTR?

26. To execute Real Time Response commands, the host must be in a(n) __________ state.

27. The __________ view enables analysts to explore the sequential behavior of one or more processes associated with a detection.

28. What role does machine learning play in detection analysis?

29. Which of the following statements best describes the use of "Tactics" in the ATT&CK Framework?

30. What is the default port used by Falcon RTR to establish a connection with a managed host?

31. Which command in Falcon RTR can you use to gather system information from an endpoint?

32. Which tool in CrowdStrike Falcon allows you to perform a deep dive into endpoint activity across your organization?

33. Which of the following contextual data is NOT typically included in a Falcon detection?

34. Which three views are available for analyzing detection process relationships in Falcon? (Choose three)

35. Which two exclusions can be configured to minimize false positives in Falcon detections? (Choose two)

36. Which of the following attributes can be viewed in the IP Search interface? (Choose three)

37. In the Falcon console, an investigator can escalate an event by marking it as high priority or assigning it for further analysis.

38. When reviewing an internal IP address via IP Search, which fields would help determine potential lateral movement? (Choose two)

39. Where can MITRE ATT&CK tactics and techniques be directly viewed in the Falcon platform?

40. Which RTR capabilities help differentiate between administrator-initiated sessions and automated workflows? (Choose two)