Confidently Practice Online with Free CCFR-201b Exam Cram

Practice your CrowdStrike Certified Falcon Responder - 2024 Version certification test with free CCFR-201b exam cram and take control of your certification preparation. At FreeExamCram, you can practice online for free using real CCFR-201b exam dumps, verified questions, and expert-designed free online practice tests. Moreover our CrowdStrike CCFR-201b exam cram backed by our confidence-boosting refund guarantee.

Question 1

Where can you find hosts that are in Reduced Functionality Mode?

Options :

A : Event Search

B : Executive Summary dashboard

C : Host Search

D : Installation Tokens

Answer: C

Question 2

From the Detections page, how can you view 'in-progress' detections assigned to Falcon Analyst Alex?

Options :

A : Filter on 'Analyst: Alex'

B : Alex does not have the correct role permissions as a Falcon Analyst to be assigned detections

C : Filter on 'Hostname: Alex' and 'Status: In-Progress'

D : Filter on 'Status: In-Progress' and 'Assigned-to: Alex

Answer: D

Question 3

You notice that taskeng.exe is one of the processes involved in a detection. What activity should you investigate next?

Options :

A : User logons after the detection

B : Executions of schtasks.exe after the detection

C : Scheduled tasks registered prior to the detection

D : Pivot to a Hash search for taskeng.exe

Answer: C

Question 4

What action is used when you want to save a prevention hash for later use?

Options :

A : Always Block

B : Never Block

C : Always Allow

D : No Action

Answer: A

Question 5

From a detection, what is the fastest way to see children and sibling process information?

Options :

A :

Select the Event Search option. Then from the Event Actions, select Show Associated Event Data (From TargetProcessId_decimal)

B : Select Full Detection Details from the detection

C : Right-click the process and select "Follow Process Chain"

D : Select the Process Timeline feature, enter the AID, Target Process ID, and Parent Process ID

Answer: C