Confidently Practice Online with Free CCFR-201b Exam Cram

Practice your CrowdStrike Certified Falcon Responder (CCFR) certification test with free CCFR-201b exam cram and take control of your certification preparation. At FreeExamCram, you can practice online for free using real CCFR-201b exam dumps, verified questions, and expert-designed free online practice tests. Moreover our CrowdStrike CCFR-201b exam cram backed by our confidence-boosting refund guarantee.

Question 1

The Falcon platform will show a maximum of how many detections per day for a single Agent Identifier (AID)?

Options :

A : 500

B : 750

C : 1000

D : 1200

Answer: C

Question 2

You are reviewing the raw data in an event search from a detection tree. You find a FileOpenInfo event and want to find out if any other files were opened by the responsible process. Which two field values do you need from this event to perform a Process Timeline search?

Options :

A : ParentProcessId_decimal and aid

B : ResponsibleProcessId_decimal and aid

C : ContextProcessId_decimal and aid

D : TargetProcessId_decimal and aid

Answer: B

Question 3

Where can you find hosts that are in Reduced Functionality Mode?

Options :

A : Event Search

B : Executive Summary dashboard

C : Host Search

D : Installation Tokens

Answer: C

Question 4

You notice that taskeng.exe is one of the processes involved in a detection. What activity should you investigate next?

Options :

A : User logons after the detection

B : Executions of schtasks.exe after the detection

C : Scheduled tasks registered prior to the detection

D : Pivot to a Hash search for taskeng.exe

Answer: C

Question 5

Which Executive Summary dashboard item indicates sensors running with unsupported versions?

Options :

A : Detections by Severity

B : Inactive Sensors

C : Sensors in RFM

D : Active Sensors

Answer: C