CCFR-201b試験無料問題集（201題）「CrowdStrike Certified Falcon Responder 認定」

出題：1

Responders use ' IP Search ' to track connections to malicious infrastructure. Which of the following statements about the IP Search is FALSE?

A. It identifies every host that connected to a specific IP.

B. It shows the first and last time the IP was seen in the environment.

C. It provides Intel data if the IP is known to CrowdStrike.

D. The search only allows for one IP to be entered at a time.

正解：D 解答を投票する

出題：2

An adversary is attempting to disable security features by modifying the system registry. Which of the following native Windows processes is specifically designed to create, modify, and delete Registry keys via the command line?

A. taskmgr.exe

B. reg.exe

C. svchost.exe

D. lsass.exe

正解：B 解答を投票する

出題：3

What types of events are returned by a Process Timeline?

A. Only process events

B. All cloudable events

C. Only detection events

D. Only network events

正解：B 解答を投票する

出題：4

To track the relationship between a parent and its child, Falcon uses specific ID fields. What raw data is used as the ' ParentProcessId_decimal ' when a process spawns a child process?

A. The ContextProcessId_decimal of the system.

B. The RootProcessId_decimal of the entire tree.

C. The TargetProcessId_decimal of the parent process.

D. The Operating System PID of the parent.

正解：C 解答を投票する

出題：5

While most searches are accessible from a detection, some require a manual jump. Which search is not available as a direct pivot from a detection?

A. Hash Search

B. Host Search

C. IP Search

D. User Search

正解：D 解答を投票する

出題：6

When examining a detection process tree, several fields are provided to give context. Which of the following is NOT included in the standard fields of a detection process tree?

A. Command Line

B. User Name

C. SHA256 Hash

D. HTTP Post contents

正解：D 解答を投票する

出題：7

The Falcon sensor can automatically upload quarantined files to the CrowdStrike Cloud for further analysis.
What is the maximum size allowed for a quarantined file to be uploaded?

A. 10MB

B. 128MB

C. 32MB

D. 64MB

正解：C 解答を投票する

出題：8

A list of managed and unmanaged neighbors for an endpoint can be found:

A. by reviewing " Groups " in Host Management under the Hosts page

B. only by searching event data using Event Search

C. by using Hosts page in the Investigate tool

D. under " Audit " by running Sensor Visibility Exclusions Audit

正解：C 解答を投票する

出題：9

Detections in Falcon are classified by their origin. Which of the following is NOT a recognized type of detection?

A. Behavioral

B. Intelligence

C. Custom IOA

D. Machine Learning

正解：A 解答を投票する

CCFR-201b試験無料問題集「CrowdStrike Certified Falcon Responder 認定」