CompTIA
Checkpoint
ISC
HP
Dell
EC-Council
EXIN
Fortinet
ITIL®
Juniper
PMI
Microsoft
VMware
Avaya
Google
Salesforce
Amazon
Palo Alto Networks
Certiport
ISC2
All Vendors
  2. Home
  3. Exams
  4. CrowdStrike
  5. CCFR-201

Free CCFR-201 Exam Braindumps (page: 3)

Page 2 of 16
PDF with 60 Questions

What is the difference between a Host Search and a Host Timeline?

  1. Results from a Host Search return information in an organized view by type, while a Host Timeline returns a view of all events recorded by the sensor
  2. A Host Timeline only includes process execution events and user account activity
  3. Results from a Host Timeline include process executions and related events organized by data type. A Host Search returns a temporal view of all events for the given host
  4. There is no difference - Host Search and Host Timeline are different names for the same search page

Answer(s): A

Explanation:

According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Host Search allows you to search for hosts based on various criteria, such as hostname, IP address, OS, etc. The results are displayed in an organized view by type, such as detections, incidents, processes, network connections, etc. The Host Timeline allows you to view all events recorded by the sensor for a given host in a chronological order. The events include process executions, file writes, registry modifications, network connections, user logins, etc.



When examining raw event data, what is the purpose of the field called ParentProcessld_decimal?

  1. It contains an internal value not useful for an investigation
  2. It contains the TargetProcessld_decimal value of the child process
  3. It contains the Sensorld_decimal value for related events
  4. It contains the TargetProcessld_decimal of the parent process

Answer(s): D

Explanation:

According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the ParentProcessld_decimal field contains the decimal value of the process ID of the parent process that spawned or injected into the target process. This field can be used to trace the process lineage and identify malicious or suspicious activities.



What action is used when you want to save a prevention hash for later use?

  1. Always Block
  2. Never Block
  3. Always Allow
  4. No Action

Answer(s): A

Explanation:

According to the CrowdStrike Falcon® Data Replicator (FDR) Add-on for Splunk Guide, the Always Block action allows you to block a file from executing on any host in your organization based on its hash value. This action can be used to prevent known malicious files from running on your endpoints.



A list of managed and unmanaged neighbors for an endpoint can be found:

  1. by using Hosts page in the Investigate tool
  2. by reviewing "Groups" in Host Management under the Hosts page
  3. under "Audit" by running Sensor Visibility Exclusions Audit
  4. only by searching event data using Event Search

Answer(s): A

Explanation:

According to the CrowdStrike Falcon® Data Replicator (FDR) Add-on for Splunk Guide, you can use the Hosts page in the Investigate tool to view information about your endpoints, such as hostname, IP address, OS, sensor version, etc. You can also see a list of managed and unmanaged neighbors for each endpoint, which are other devices that have communicated with that endpoint over the network. This can help you identify potential threats or vulnerabilities in your network.






Post your Comments and Discuss CrowdStrike CCFR-201 exam with other Community members:

CCFR-201 Discussions & Posts