QUESTION: 9

What happens when a hash is allowlisted?

Execution is prevented, but detection alerts are suppressed
Execution is allowed on all hosts, including all other Falcon customers
The hash is submitted for approval to be allowed to execute once confirmed by Falcon specialists
Execution is allowed on all hosts that fall under the organization's CID

Answer(s): D

Explanation:

According to the CrowdStrike Falcon® Data Replicator (FDR) Add-on for Splunk Guide, the allowlist feature allows you to exclude files or directories from being scanned or blocked by CrowdStrike's machine learning engine or indicators of attack (IOAs)2. This can reduce false positives and improve performance.
When you allowlist a hash, you are allowing that file to execute on any host that belongs to your organization's CID (customer ID)2. This does not affect other Falcon customers or hosts outside your CID2.

Reveal Solution Next Question

QUESTION: 10

Which of the following is returned from the IP Search tool?

IP Summary information from Falcon events containing the given IP
Threat Graph Data for the given IP from Falcon sensors
Unmanaged host data from system ARP tables for the given IP D. IP Detection Summary information for detection events containing the given IP

Answer(s): A

Explanation:

According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the IP Search tool allows you to search for an IP address and view a summary of information from Falcon events that contain that IP address. The summary includes the hostname, sensor ID, OS, country, city, ISP, ASN, and geolocation of the host that communicated with that IP address.

Reveal Solution Next Question

QUESTION: 11

Which is TRUE regarding a file released from quarantine?

No executions are allowed for 14 days after release
It is allowed to execute on all hosts
It is deleted
It will not generate future machine learning detections on the associated host

Answer(s): B

Explanation:

According to the CrowdStrike Falcon® Data Replicator (FDR) Add-on for Splunk Guide, when you release a file from quarantine, you are restoring it to its original location and allowing it to execute on any host in your organization. This action also removes the file from the quarantine list and deletes it from the CrowdStrike Cloud.

Reveal Solution Next Question

QUESTION: 12

Which of the following is an example of a MITRE ATT&CK tactic?

Eternal Blue
Defense Evasion
Emotet
Phishing

Answer(s): B

Explanation:

According to the [MITRE ATT&CK website], MITRE ATT&CK is a knowledge base of adversary behaviors and techniques based on real-world observations. The knowledge base is organized into tactics and techniques, where tactics are the high-level goals of an adversary, such as initial access, persistence, lateral movement, etc., and techniques are the specific ways an adversary can achieve those goals, such as phishing, credential dumping, remote file copy, etc. Defense Evasion is one of the tactics defined by MITRE ATT&CK, which covers actions that adversaries take to avoid detection or prevent security controls from blocking their activities. Eternal Blue, Emotet, and Phishing are examples of techniques, not tactics.

Reveal Solution Next Question

Free CCFR-201 Exam Braindumps (page: 3)

QUESTION: 9

Explanation:

QUESTION: 10

Explanation:

QUESTION: 11

Explanation:

QUESTION: 12

Explanation: