Online Access Free CCFR-201 Exam Questions

When analyzing an executable with a global prevalence of common; but you do not know what the executable is. what is the best course of action?

• A.From detection, use API manager to create a custom blocklist
• B.From detection, click the VT Hash button to pivot to VirusTotal to investigate further
• C.Do nothing, as this file is common and well known
• D.From detection, submit to FalconX for deep dive analysis

What happens when a hash is set to Always Block through IOC Management?

• A.The hash is submitted for approval to be blocked from execution once confirmed by Falcon specialists
• B.Execution is prevented on all hosts by default
• C.Execution is prevented and detection alerts are suppressed
• D.Execution is prevented on selected host groups

What is an advantage of using a Process Timeline?

• A.Suspicious processes are color-coded based on their frequency and legitimacy over time
• B.Processes responsible for spikes in CPU performance are displayed overtime
• C.A visual representation of Parent-Child and Sibling process relationships is provided
• D.Process related events can be filtered to display specific event types

Which of the following is NOT a valid event type?

• A.DnsRequest
• B.ProcessRollup2
• C.StartofProcess
• D.EndofProcess

Which of the following tactic and technique combinations is sourced from MITRE ATT&CK information?

• A.Malware via PUP
• B.Falcon Intel via Intelligence Indicator - Domain
• C.Machine Learning via Cloud-Based ML
• D.Credential Access via OS Credential Dumping