CCFR-201b CrowdStrike Certified Falcon Responder exact Exam Questions

CrowdStrike Certified Falcon Responder

Last Update 18 hours ago Total Questions : 209

The CrowdStrike Certified Falcon Responder content is now fully updated, with all current exam questions added 18 hours ago. Deciding to include CCFR-201b practice exam questions in your study plan goes far beyond basic test preparation.

You'll find that our CCFR-201b exam questions frequently feature detailed scenarios and practical problem-solving exercises that directly mirror industry challenges. Engaging with these CCFR-201b sample sets allows you to effectively manage your time and pace yourself, giving you the ability to finish any CrowdStrike Certified Falcon Responder practice test comfortably within the allotted time.

Question # 1

After pivoting to an event search from a detection, you locate the ProcessRollup2 event. Which two field values are you required to obtain to perform a Process Timeline search so you can determine what the process was doing?

SHA256 and TargetProcessld_decimal

SHA256 and ParentProcessld_decimal

aid and ParentProcessld_decimal

aid and TargetProcessld_decimal

Question # 2

In the ' Investigate > Hunt > Linux Sensors ' dashboard, responders can view various Linux-specific activities. Which of the following sub-titling is NOT displayed in this dashboard?

Sudo Executions

Cron Usage

Kernel Module Loads

User Logins

Question # 3

You are pre-staging a Custom IOC for later use and want to save a file hash for later use after approval.

Which action should you use?

Save Hash

Monitor

No Action

Always Block

Question # 4

The Falcon console is divided into several modules. Timelines (Host and Process) are technically a part of which Falcon page?

Activity

Investigate

Configuration

Dashboards

Question # 5

CrowdStrike supports various deployment types. What is a ' POD sensor ' ?

A sensor specifically designed for mobile devices (iOS/Android).

A sensor that is installed directly on a Kubernetes or Docker host to monitor containers.

A legacy sensor used only for disconnected or air-gapped systems.

A physical appliance that sits on the network to monitor traffic.

Question # 6

A responder needs to find a specific sequence of network connections that did not trigger a detection. Which search tool allows them to search for anything within the raw telemetry?

Host Search

Event Search

Hash Search

User Search

Question # 7

After an investigation, the following malicious artifacts have been identified:

C:\Users*\AppData\iamnotmalware.exe

C:\Users*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iamnotmalware.lnk

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iamnotmalware_really

What method will remove all associated artifacts from hosts that trigger future related detections?

Create a Quarantine Rule that will quarantine all identified artifacts across the entire environment

Create Custom IOA rules to prevent the execution of these artifacts

Create a workflow to trigger on a new endpoint detection, query the telemetry data of the endpoint for known artifacts, and select Remove All Associated Artifacts as an action

Create a workflow to trigger on a new endpoint detection, conditions that match the detection, and as an action a PowerShell script to kill associated processes and remove all artifacts

Question # 8

A responder has identified a suspicious PowerShell script executing on a domain controller. To perform a deep-dive forensic analysis of every action taken by that specific process—including network connections and file modifications—the analyst needs to pivot to a Process Timeline. What is the absolute minimum telemetry data required to generate this auto-filled view?

Agent ID (AID) and Local IP Address

Agent ID (AID) and Target Process ID (TargetProcessId_decimal)

Hostname and MAC Address

User SID and SHA256 Hash