CCFR-201試験無料問題集（63題）「CrowdStrike Certified Falcon Responder 認定」

出題：1

After running an Event Search, you can select many Event Actions depending on your results. Which of the following is NOT an option for any Event Action?

A. Draw Process Explorer

B. Show Associated Event Data (from TargetProcessld_decimal or ContextProcessld_decimal)

C. Show a Process Timeline for the responsible process

D. Show a +/- 10-minute window of events

正解：A 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：2

You notice that taskeng.exe is one of the processes involved in a detection. What activity should you investigate next?

A. Scheduled tasks registered prior to the detection

B. Executions of schtasks.exe after the detection

C. Pivot to a Hash search for taskeng.exe

D. User logons after the detection

正解：A 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：3

What action is used when you want to save a prevention hash for later use?

A. Never Block

B. No Action

C. Always Block

D. Always Allow

正解：C 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：4

What does pivoting to an Event Search from a detection do?

A. It takes you to the raw Insight event data and provides you with a number of Event Actions

B. It takes you to a Process Timeline for that detection so you can see all related events

C. It gives you the ability to search for similar events on other endpoints quickly

D. It allows you to input an event type, such as DNS Request or ASEP write, and search for those events within the detection

正解：A 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：5

You found a list of SHA256 hashes in an intelligence report and search for them using the Hash Execution Search. What can be determined from the results?

A. Identifies detections related to the specified hashes

B. Identifies hosts that loaded or executed the specified hashes

C. Identifies users associated with the specified hashes

D. Identifies a detailed list of all process executions for the specified hashes

正解：B 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：6

What are Event Actions?

A. Custom event data queries bookmarked by the currently signed in Falcon user

B. Pivotable hyperlinks available in a Host Search

C. Raw Falcon event data

D. Automated searches that can be used to pivot between related events and searches

正解：D 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：7

What do IOA exclusions help you achieve?

A. Reduce false positives based on Next-Gen Antivirus settings in the Prevention Policy

B. Reduce false positives of behavioral detections from IOA based detections only

C. Reduce false positives of behavioral detections from Custom IOA and OverWatch detections only

D. Reduce false positives of behavioral detections from IOA based detections based on a file hash

正解：B 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

CCFR-201試験無料問題集「CrowdStrike Certified Falcon Responder 認定」