QUESTION: 1

After pivoting to an event search from a detection, you locate the ProcessRollup2 event.
Which two field values are you required to obtain to perform a Process Timeline search so you can determine what the process was doing?

SHA256 and TargetProcessld_decimal
SHA256 and ParentProcessld_decimal
aid and ParentProcessld_decimal
aid and TargetProcessld_decimal

Answer(s): D

Explanation:

According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Process Timeline search requires two parameters: aid (agent ID) and TargetProcessId_decimal (the decimal value of the process ID). These fields can be obtained from the ProcessRollup2 event, which contains information about processes that have executed on a host.

Reveal Solution Next Question

QUESTION: 2

The function of Machine Learning Exclusions is to___________.

stop all detections for a specific pattern ID
stop all sensor data collection for the matching path(s)
Stop all Machine Learning Preventions but a detection will still be generated and files will still be uploaded to the CrowdStrike Cloud
stop all ML-based detections and preventions for the matching path(s) and/or stop files from being uploaded to the CrowdStrike Cloud

Answer(s): D

Explanation:

According to the CrowdStrike Falcon® Data Replicator (FDR) Add-on for Splunk Guide, Machine Learning Exclusions allow you to exclude files or directories from being scanned by CrowdStrike's machine learning engine, which can reduce false positives and improve performance. You can also choose whether to upload the excluded files to the CrowdStrike Cloud or not.

Reveal Solution Next Question

QUESTION: 3

What happens when you create a Sensor Visibility Exclusion for a trusted file path?

It excludes host information from Detections and Incidents generated within that file path location
It prevents file uploads to the CrowdStrike cloud from that file path
It excludes sensor monitoring and event collection for the trusted file path
It disables detection generation from that path, however the sensor can still perform prevention actions

Answer(s): C

Explanation:

According to the CrowdStrike Falcon® Data Replicator (FDR) Add-on for Splunk Guide, Sensor Visibility Exclusions allow you to exclude certain files or directories from being monitored by the CrowdStrike sensor, which can reduce noise and improve performance. This means that no events will be collected or sent to the CrowdStrike Cloud for those files or directories.

Reveal Solution Next Question

QUESTION: 4

What types of events are returned by a Process Timeline?

Only detection events
All cloudable events
Only process events
Only network events

Answer(s): B

Explanation:

According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Process Timeline search returns all cloudable events associated with a given process, such as process creation, network connections, file writes, registry modifications, etc. This allows you to see a comprehensive view of what a process was doing on a host.

Reveal Solution Next Question

Free CCFR-201 Exam Braindumps (page: 1)

Pass your CrowdStrike Certified Falcon Responder exam with these free Actual Questions and Answers

QUESTION: 1

Explanation:

QUESTION: 2

Explanation:

QUESTION: 3

Explanation:

QUESTION: 4

Explanation: