CrowdStrike Certified Falcon Responder - CCFR-201 Free Exam Questions

A. A visual representation of Parent-Child and Sibling process relationships is provided

B. Process related events can be filtered to display specific event types

C. Processes responsible for spikes in CPU performance are displayed overtime

D. Suspicious processes are color-coded based on their frequency and legitimacy over time

A. IP searches provide host, process, and organizational unit data without the need to write a query

B. IP searches provide manufacture and timezone data that can not be accessed anywhere else

C. IP searches offer shortcuts to launch response actions and network containment on target hosts

D. IP searches allow for multiple comma separated IPv6 addresses as input

A. It is allowed to execute on all hosts

B. It is deleted

C. It will not generate future machine learning detections on the associated host

D. No executions are allowed for 14 days after release

A. An adversary is trying to keep access through persistence by creating an account

B. adversary is trying to keep access through persistence using application skimming

C. An adversary is trying to keep access through persistence using browser extensions

D. An adversary is trying to keep access through persistence using external remote services

A. Kleene Star Syntax

B. SPL(Splunk)

C. RegEx

D. Glob Syntax

A. Spotlight

B. Discover

C. Falcon X

D. Investigate

A. It is a system that attributes an attack techniques to a specific threat actor

B. It provides the phases of an adversary's lifecycle, the platforms they are known to attack, and the specific methods they use

C. It provides best practices for different cybersecurity domains, such as Identify and Access Management

D. It provides a step-by-step cyber incident response strategy