Online Access Free CCFR-201b Practice Test

According to the Falcon Overwatch Best Practice workflow, what is the required next step after a responder completes the ' Understand the process(es) involved ' step?

• A.Examine what is normal for the system to identify deviations.
• B.Pivot to the Intelligence dashboard for actor attribution.
• C.Delete the malicious file from the endpoint.
• D.Isolate the host to prevent lateral movement.

Multiple detections with the process schtasks.exe begin to alert in the UI. The process executes the following command line on several unique hosts:
schtasks.exe /Query /TN " Qljsscdqr "
What is the most efficient way to identify which hosts are executing this scheduled task?

• A.Filter detections by the triggering file and sort by ' Host:A to Z '
• B.Filter detections by command line and group by host
• C.Filter detections by command line and sort by ' Host:A to Z '
• D.Filter detections by command line and group by triggering file

While in an Event Search, a responder clicks on an event action. What does the ' Show Child Processes ' event action do?

• A.It generates a new Event Search based on the specific Event Action and Parent PID.
• B.It automatically terminates all children of that process on the endpoint.
• C.It pivots to the Host Search for the machine where the process ran.
• D.It displays a list of children in a new graphical tree.

When examining a raw DNS request event, you see a field called ContextProcessld_decimal. What is the purpose of that field?

• A.It contains the TargetProcessld_decimal value for the process that made the DNS request
• B.It contains the ContextProcessld_decimal value for the parent process that made the DNS request
• C.It contains an internal value not useful for an investigation
• D.It contains the TargetProcessld_decimal value for other related events

While quarantined files stay on the local host for 30 days by default, how many days does a quarantined file remain stored in the CrowdStrike Cloud?

• A.60 days
• B.180 days
• C.30 days
• D.90 days