Online Access Free CCFR-201b Exam Questions

When a responder is looking at the ' Full Detection Details ' page, they can toggle between several views.
Which of the following is NOT a layout option available for viewing these details?

• A.Graph View
• B.Process Timeline
• C.Tree View
• D.List View

Which specific event type in the Falcon telemetry is associated with the creation of a new ' TargetProcessId_decimal ' ?

• A.ProcessRollup2
• B.NetworkConnect
• C.RegistryUpdate
• D.FileCreation

A responder is unsure about the difference between ' Detection ' and ' Prevention ' settings. Where can they find information about Detection and Prevention Policies?

• A.By clicking the ' About ' button in the user profile.
• B.In the Support page under the Docs section.
• C.In the training videos on the main Dashboard.
• D.On the public CrowdStrike blog.

A responder is analyzing a process tree where a suspicious executable is listed as a direct child of services.
exe. In this scenario, which source is most likely responsible for the execution?

• A.A script executed directly from a removable USB drive.
• B.A Windows Service or a process launched by the Service Control Manager.
• C.A web browser download initiated by the end user.
• D.An interactive user login via RDP.

What is the difference between a Host Search and a Host Timeline?

• A.A Host Timeline only includes process execution events and user account activity
• B.Results from a Host Search return information in an organized view by type, while a Host Timeline returns a view of all events recorded by the sensor
• C.Results from a Host Timeline include process executions and related events organized by data type. A Host Search returns a temporal view of all events for the given host
• D.There is no difference - Host Search and Host Timeline are different names for the same search page