CCFR-201試験問題集、CCFR-201練習テスト問題 [Q26-Q48]

CCFR-201試験問題集、CCFR-201練習テスト問題

PDF問題（2023年最新）実際のCrowdStrike CCFR-201試験問題

質問 # 26
You can jump to a Process Timeline from many views, like a Hash Search, by clicking which of the following?

• A. PID
• B. Process ID or Parent Process ID
• C. ProcessTimeline Link
• D. UTCtime

正解：B

解説：
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Process Timeline tool allows you to view all cloudable events associated with a given process, such as process creation, network connections, file writes, registry modifications, etc1. The tool requires two parameters: aid (agent ID) and TargetProcessId_decimal (the decimal value of the process ID)1. You can jump to a Process Timeline from many views, such as Hash Search, Host Timeline, Event Search, etc., by clicking on either the Process ID or Parent Process ID fields in those views1. This will automatically populate the aid and TargetProcessId_decimal parameters for the Process Timeline tool1.

質問 # 27
The Process Activity View provides a rows-and-columns style view of the events generated in a detection.
Why might this be helpful?

• A. The Process Activity View will show the Detection time of the earliest recorded activity which might indicate first affected machine
• B. The Process Activity View creates a consolidated view of all detection events for that process that can be exported for further analysis
• C. The Process Activity View only creates a summary of Dynamic Link Libraries (DLLs) loaded by a process
• D. The Process Activity View creates a count of event types only, which can be useful when scoping the event

正解：B

解説：
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Process Activity View allows you to view all events generated by a process involved in a detection in a rows-and-columns style view1. This can be helpful because it creates a consolidated view of all detection events for that process that can be exported for further analysis1. You can also sort, filter, and pivot on the events by various fields, such as event type, timestamp, file name, registry key, network destination, etc1.

質問 # 28
What are Event Actions?

• A. Custom event data queries bookmarked by the currently signed in Falcon user
• B. Pivotable hyperlinks available in a Host Search
• C. Raw Falcon event data
• D. Automated searches that can be used to pivot between related events and searches

正解：D

解説：
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, Event Actions are automated searches that can be used to pivot between related events and searches1. They are available in various tools, such as Event Search, Process Timeline, Host Timeline, etc1. You can select one or more events and perform various actions, such as show a process timeline, show a host timeline, show associated event data, show a +/- 10-minute window of events, etc1. These actions can help you investigate and analyze events more efficiently and effectively1.

質問 # 29
After pivoting to an event search from a detection, you locate the ProcessRollup2 event. Which two field values are you required to obtain to perform a Process Timeline search so you can determine what the process was doing?

• A. SHA256 and TargetProcessld_decimal
• B. aid and ParentProcessld_decimal
• C. aid and TargetProcessld_decimal
• D. SHA256 and ParentProcessld_decimal

正解：C

解説：
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Process Timeline search requires two parameters: aid (agent ID) and TargetProcessId_decimal (the decimal value of the process ID). These fields can be obtained from the ProcessRollup2 event, which contains information about processes that have executed on a host1.

質問 # 30
Sensor Visibility Exclusion patterns are written in which syntax?

• A. RegEx
• B. Glob Syntax
• C. Kleene Star Syntax
• D. SPL(Splunk)

正解：B

解説：
Explanation
According to the [CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide], Sensor Visibility Exclusions allow you to exclude files or directories from being monitored by the sensor. This can reduce the amount of data sent to the CrowdStrike Cloud and improve performance. Sensor Visibility Exclusion patterns are written in Glob Syntax, which is a simple pattern matching syntax that supports wildcards, such as *, ?, and . For example, you can use *.exe to exclude all files with .exe extension.

質問 # 31
Which Executive Summary dashboard item indicates sensors running with unsupported versions?

• A. Active Sensors
• B. Detections by Severity
• C. Inactive Sensors
• D. Sensors in RFM

正解：D

解説：
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Executive Summary dashboard provides an overview of your sensor health and activity1. It includes various items, such as Active Sensors, Inactive Sensors, Detections by Severity, etc1. The item that indicates sensors running with unsupported versions is Sensors in RFM (Reduced Functionality Mode)1. RFM is a state where a sensor has limited functionality due to various reasons, such as license expiration, network issues, tampering attempts, or unsupported versions1. You can see the number and percentage of sensors in RFM and the reasons why they are in RFM1.

質問 # 32
What is the difference between a Host Search and a Host Timeline?

• A. There is no difference - Host Search and Host Timeline are different names for the same search page
• B. A Host Timeline only includes process execution events and user account activity
• C. Results from a Host Timeline include process executions and related events organized by data type. A Host Search returns a temporal view of all events for the given host
• D. Results from a Host Search return information in an organized view by type, while a Host Timeline returns a view of all events recorded by the sensor

正解：D

解説：
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Host Search allows you to search for hosts based on various criteria, such as hostname, IP address, OS, etc1. The results are displayed in an organized view by type, such as detections, incidents, processes, network connections, etc1. The Host Timeline allows you to view all events recorded by the sensor for a given host in a chronological order1. The events include process executions, file writes, registry modifications, network connections, user logins, etc1.

質問 # 33
A list of managed and unmanaged neighbors for an endpoint can be found:

• A. by reviewing "Groups" in Host Management under the Hosts page
• B. only by searching event data using Event Search
• C. by using Hosts page in the Investigate tool
• D. under "Audit" by running Sensor Visibility Exclusions Audit

正解：C

解説：
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, you can use the Hosts page in the Investigate tool to view information about your endpoints, such as hostname, IP address, OS, sensor version, etc2. You can also see a list of managed and unmanaged neighbors for each endpoint, which are other devices that have communicated with that endpoint over the network2. This can help you identify potential threats or vulnerabilities in your network2.

質問 # 34
You notice that taskeng.exe is one of the processes involved in a detection. What activity should you investigate next?

• A. Pivot to a Hash search for taskeng.exe
• B. Executions of schtasks.exe after the detection
• C. Scheduled tasks registered prior to the detection
• D. User logons after the detection

正解：C

解説：
Explanation
According to the [Microsoft website], taskeng.exe is a legitimate Windows process that is responsible for running scheduled tasks. However, some malware may use this process or create a fake one to execute malicious code. Therefore, if you notice taskeng.exe involved in a detection, you should investigate whether there are any scheduled tasks registered prior to the detection that may have triggered or injected into taskeng.exe. You can use tools such as schtasks.exe or Task Scheduler to view or manage scheduled tasks.

質問 # 35
Which statement is TRUE regarding the "Bulk Domains" search?

• A. It will show a list of computers and process that performed a lookup of any of the domains in your search
• B. The "Bulk Domains" search will show IP address and port information for any associated connectionsD.You should only pivot to the "Bulk Domains" search tool after completing an investigation
• C. The "Bulk Domains" search will allow you to blocklist your queried domains

正解：A

解説：
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Bulk Domain Search tool allows you to search for one or more domains and view a summary of information from Falcon events that contain those domains2. The summary includes the hostname, sensor ID, OS, country, city, ISP, ASN, geolocation, process name, command line, and organizational unit of the host that performed a lookup of any of the domains in your search2. This can help you identify potential threats or vulnerabilities in your network2.

質問 # 36
When analyzing an executable with a global prevalence of common; but you do not know what the executable is. what is the best course of action?

• A. From detection, use API manager to create a custom blocklist
• B. From detection, submit to FalconX for deep dive analysis
• C. Do nothing, as this file is common and well known
• D. From detection, click the VT Hash button to pivot to VirusTotal to investigate further

正解：D

解説：
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, global prevalence is a field that indicates how frequently the hash of a file is seen across all CrowdStrike customer environments1. A global prevalence of common means that the file is widely distributed and likely benign1. However, if you do not know what the executable is, you may want to investigate it further to confirm its legitimacy and functionality1. One way to do that is to click the VT Hash button from the detection, which will pivot you to VirusTotal, a service that analyzes files and URLs for viruses, malware, and other threats1. You can then see more information about the file, such as its name, size, type, signatures, detections, comments, etc1.

質問 # 37
How long does detection data remain in the CrowdStrike Cloud before purging begins?

• A. 90 Days
• B. 45 Days
• C. 14 Days
• D. 30 Days

正解：A

解説：
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, detection data is stored in the CrowdStrike Cloud for 90 days before purging begins2. This means that you can access and view detections from the past 90 days using the Falcon platform or API2. If you want to retain detection data for longer than 90 days, you can use FDR to replicate it to your own storage system2.

質問 # 38
In the Hash Search tool, which of the following is listed under Process Executions?

• A. File Signature
• B. Sensor Version
• C. Operating System
• D. Command Line

正解：D

解説：
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Hash Search tool allows you to search for one or more SHA256 hashes and view a summary of information from Falcon events that contain those hashes1. The summary includes the hostname, sensor ID, OS, country, city, ISP, ASN, geolocation, process name, command line, and organizational unit of the host that loaded or executed those hashes1. You can also see a count of detections and incidents related to those hashes1. Under Process Executions, you can see the process name and command line for each hash execution1.

質問 # 39
What does the Full Detection Details option provide?

• A. It provides a detailed list of detection events via the Process Tree View
• B. It provides a visualization of program ancestry via the Process Activity View
• C. It provides detailed list of detection events via the Process Table View
• D. It provides a visualization of program ancestry via the Process Tree View

正解：D

解説：
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Full Detection Details option allows you to view detailed information about a detection, such as detection ID, severity, tactic, technique, description, etc1. You can also view the events generated by the processes involved in the detection in different ways, such as process tree, process timeline, or process activity1. The process tree view provides a visualization of program ancestry, which shows the parent-child and sibling relationships among the processes1. You can also see the event types and timestamps for each process1.

質問 # 40
What action is used when you want to save a prevention hash for later use?

• A. Always Allow
• B. Never Block
• C. No Action
• D. Always Block

正解：D

解説：
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, the Always Block action allows you to block a file from executing on any host in your organization based on its hash value2. This action can be used to prevent known malicious files from running on your endpoints2.

質問 # 41
How long are quarantined files stored in the CrowdStrike Cloud?

• A. 90 Days
• B. 45 Days
• C. Quarantined files are not deleted
• D. Days

正解：A

解説：
Explanation
According to the [CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide], when you quarantine a file from a host using IOC Management or Real Time Response (RTR), you are moving it from its original location to a secure location on the host where it cannot be executed. The file is also encrypted and renamed with a random string of characters. A copy of the file is also uploaded to the CrowdStrike Cloud for further analysis. Quarantined files are stored in the CrowdStrike Cloud for 90 days before they are deleted.

質問 # 42
Which is TRUE regarding a file released from quarantine?

• A. No executions are allowed for 14 days after release
• B. It is allowed to execute on all hosts
• C. It is deleted
• D. It will not generate future machine learning detections on the associated host

正解：B

解説：
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, when you release a file from quarantine, you are restoring it to its original location and allowing it to execute on any host in your organization2. This action also removes the file from the quarantine list and deletes it from the CrowdStrike Cloud2.

質問 # 43
What happens when you create a Sensor Visibility Exclusion for a trusted file path?

• A. It disables detection generation from that path, however the sensor can still perform prevention actions
• B. It excludes host information from Detections and Incidents generated within that file path location
• C. It excludes sensor monitoring and event collection for the trusted file path
• D. It prevents file uploads to the CrowdStrike cloud from that file path

正解：C

解説：
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, Sensor Visibility Exclusions allow you to exclude certain files or directories from being monitored by the CrowdStrike sensor, which can reduce noise and improve performance2. This means that no events will be collected or sent to the CrowdStrike Cloud for those files or directories2.

質問 # 44
Where can you find hosts that are in Reduced Functionality Mode?

• A. Event Search
• B. Installation Tokens
• C. Host Search
• D. Executive Summary dashboard

正解：C

解説：
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, Reduced Functionality Mode (RFM) is a state where a host's sensor has limited functionality due to various reasons, such as license expiration, network issues, tampering attempts, etc1. You can find hosts that are in RFM by using the Host Search tool and filtering by Sensor Status = RFM1. You can also view details about why a host is in RFM by clicking on its hostname1.

質問 # 45
The Bulk Domain Search tool contains Domain information along with which of the following?

• A. IP Lookup Information
• B. Port Information
• C. Process Information
• D. Threat Actor Information

正解：A

解説：
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Bulk Domain Search tool allows you to search for one or more domains and view a summary of information from Falcon events that contain those domains1. The summary includes the domain name, IP address, country, city, ISP, ASN, geolocation, hostname, sensor ID, OS, process name, command line, and organizational unit of the host that communicated with those domains1. This means that the tool contains domain information along with IP lookup information1.

質問 # 46
Within the MITRE-Based Falcon Detections Framework, what is the correct way to interpret Keep Access > Persistence > Create Account?

• A. An adversary is trying to keep access through persistence using external remote services
• B. An adversary is trying to keep access through persistence using browser extensions
• C. An adversary is trying to keep access through persistence by creating an account
• D. adversary is trying to keep access through persistence using application skimming

正解：C

解説：
Explanation
According to the [CrowdStrike website], the MITRE-Based Falcon Detections Framework is a way of categorizing and describing detections based on the MITRE ATT&CK knowledge base ofadversary behaviors and techniques. The framework uses three levels of granularity: category, tactic, and technique. The category is the highest level and represents the main objective of an adversary, such as initial access, execution, credential access, etc. The tactic is the second level and represents the sub-objective of an adversary within a category, such as persistence, privilege escalation, defense evasion, etc. The technique is the lowest level and represents the specific way an adversary can achieve a tactic, such as create account, modify registry, obfuscated files or information, etc. Therefore, the correct way to interpret Keep Access > Persistence > Create Account is that an adversary is trying to keep access through persistence by creating an account.

質問 # 47
What does pivoting to an Event Search from a detection do?

• A. It takes you to a Process Timeline for that detection so you can see all related events
• B. It takes you to the raw Insight event data and provides you with a number of Event Actions
• C. It gives you the ability to search for similar events on other endpoints quickly
• D. It allows you to input an event type, such as DNS Request or ASEP write, and search for those events within the detection

正解：B

解説：
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, pivoting to an Event Search from a detection takes you to the raw Insight event data and provides you with a number of Event Actions1. Insight events are low-level events that are generated by the sensor for various activities, such as process executions, file writes, registry modifications, network connections, etc1. You can view these events in a table format and use various filters and fields to narrow down the results1. You can also select one or more events and perform various actions, such as show a process timeline, show a host timeline, show associated event data, show a +/- 10-minute window of events, etc1. These actions can help you investigate and analyze events more efficiently and effectively1.

質問 # 48
......

更新された2023年11月合格させるCCFR-201試験リアル練習テスト問題：https://www.goshiken.com/CrowdStrike/CCFR-201-mondaishu.html

問題集返金保証付きのCCFR-201問題集には90%オフ：https://drive.google.com/open?id=1tqX8BpjgC1lVD8dBK-kVRpGqZzA0Sqeu