Falcon Responder CCFR-201 Practice Questions & Answers • ExamPrepare

78 questions in this view

Page 1 of 13

Question 1

How much experience do you have as a Falcon Responder?

< 6 months
7–11 months
1–2 years
> 2 years

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 2

How closely did the questions on the exam align to your experience as a Falcon Responder?

Very aligned
Somewhat aligned
Not at all aligned

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 3

What action is needed to ensure Falcon does not block or generate a detection for a process by using the file hash?

Create a custom IOC with an action of allow for the hash
Create a custom IOA with an action of allow for the hash
Create a machine learning exclusion with an action of allow for the hash
Create an IOA exclusion with an action of allow for the hash

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 4

You are triaging detections and notice two high severity endpoint detections. The first detection is on a workstation used by a standard employee, and the second detection is on a domain controller.

Which detection should be prioritized?

The detection on the workstation, because workstations are more frequently targeted and represent a higher likelihood of lateral movement
The detection on the domain controller, because severity reflects the detection itself and asset context should factor into prioritization decisions
Both detections should be prioritized equally, since both are high severity detections and require urgent response
The detection on the workstation, because severity in Falcon accounts for asset criticality, so equal scores indicate equal risk regardless of the host type

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 5

What happens when a quarantined file is released? It is allowed to execute on the host and still generates detections on the host It is allowed to execute on the host It is allowed to execute on all hosts

What happens when a quarantined file is released?

It is allowed to execute on the host and still generates detections on the host

It is allowed to execute on the host

It is allowed to execute on all hosts

It is allowed to execute on the host
It is allowed to execute on the host and still generates detections on the host
It is moved into the C:\CrowdStrike\Quarantine\Released folder on the host
It is allowed to execute on all hosts

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 6

While investigating a detection, you open the full detection view and observe a severity rating of Critical, a MITRE tactic of Credential Access, and a command line containing Mimikatz.exe.

What is the appropriate response based on this information?

Close the detection as a true positive and document the MITRE technique
Apply a machine learning exclusion to reduce future detections of this behavior
Monitor the host for additional detections before taking action
Contain the host immediately and escalate for further investigation

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.