View Full CrowdStrike CCFR-201 Exam Dumps and Practice Test Dumps

 

Question 161.

An analyst observes that a suspicious process was started by an unexpected application. Which relationship should be investigated to identify the source of execution?

1. Parent process
   2. Child process
   3. Host group
   4. Sensor policy

Correct Answer: 1. Parent process

Explanation:

The parent process identifies the process that directly launched another process. Reviewing this relationship helps analysts understand how suspicious execution began and may expose abnormal behavior, such as an office application starting a command shell or scripting engine. Child processes show what was launched afterward, while host groups and sensor policies provide administrative information rather than execution context. Examining the parent process is therefore the most direct way to identify the origin of suspicious process activity and reconstruct the beginning of an execution chain.

Question 162.

A responder has identified a suspicious file hash and wants to determine whether the same file appears elsewhere in the environment. Which capability should be used?

1. User Search
   2. Hash Search
   3. IP Search
   4. Host Timeline

Correct Answer: 2. Hash Search

Explanation:

Hash Search is designed to investigate a specific file hash across the environment. It can help responders identify other endpoints where the same file has appeared and determine whether suspicious activity is isolated or more widespread. User Search focuses on identities, IP Search examines network addresses, and Host Timeline provides chronological endpoint activity. When the starting indicator is a file hash, Hash Search provides the most direct method for finding related systems and gathering additional context about the file’s presence within the organization.

Question 163.

An analyst wants to review endpoint activity in chronological order across an entire host. Which capability is most appropriate?

1. Process Timeline
   2. User Search
   3. Host Timeline
   4. Hash management

Correct Answer: 3. Host Timeline

Explanation:

Host Timeline provides a chronological view of activity occurring across an endpoint. It is useful when responders need to reconstruct what happened before, during, and after suspicious behavior. Process Timeline is more narrowly focused on one process, while User Search and hash management address different investigation or control requirements. A host-wide timeline can reveal related events that may not be visible in the original detection and help the analyst understand the overall sequence of activity during a suspected compromise.

Question 164.

A security responder needs to remotely execute approved commands and inspect files on an affected endpoint. Which capability should be selected?

1. Detection filters
   2. Bulk Domain Search
   3. Hash Search
   4. Real Time Response

Correct Answer: 4. Real Time Response

Explanation:

Real Time Response enables authorized responders to interact directly with supported endpoints during an investigation. Through RTR, they can execute approved commands, inspect files, gather evidence, and perform remediation actions remotely. Detection filters help organize alerts, while Bulk Domain Search and Hash Search investigate indicators without providing direct endpoint control. Because RTR can perform powerful actions on systems, access should be appropriately restricted and activity should be auditable. RTR is therefore the appropriate capability for remote endpoint investigation and remediation.

Question 165.

An analyst notes that a suspicious file has been observed on only a single endpoint. Which concept is being evaluated?

1. Internal prevalence
   2. Detection severity
   3. Host containment
   4. User permission

Correct Answer: 1. Internal prevalence

Explanation:

Internal prevalence indicates how common or rare an artifact is within the organization’s own environment. A file seen on only one endpoint has low internal prevalence and may deserve closer investigation, particularly when other suspicious evidence exists. Low prevalence alone does not prove maliciousness, so it should be considered alongside process behavior, reputation, network activity, and other indicators. Detection severity, containment status, and user permissions describe different security properties and do not measure how widely a file appears across systems.

Question 166.

A hash is confirmed to represent malicious software and the organization wants to prevent its execution. Which action should be applied?

1. Allow
   2. Block
   3. Detect Only
   4. No action

Correct Answer: 2. Block

Explanation:

Block is the appropriate action when a file hash has been confirmed as malicious and the organization wants to prevent execution. Detect Only provides visibility without the same prevention effect, while Allow is intended for trusted files. No action does not satisfy the requirement to stop the malicious executable. Before applying a block, responders should validate the hash carefully to avoid disrupting legitimate software. Hash-management decisions should always reflect the intended balance between prevention, visibility, and operational impact.

Question 167.

An investigation is centered on a specific username that may have been involved in suspicious activity. Which capability should be used first?

1. User Search
   2. Hash Search
   3. Process Tree
   4. Bulk Domain Search

Correct Answer: 1. User Search

Explanation:

User Search is the most appropriate starting point when an investigation begins with a username or user account. It provides account-related context and can help identify systems or events associated with the identity. The responder can then pivot into detections, processes, host activity, or network indicators as needed. Hash Search focuses on files, Process Tree focuses on process relationships, and Bulk Domain Search investigates domain indicators. User Search therefore keeps the investigation aligned with the known identity and helps uncover related activity efficiently.

Question 168.

A suspicious IP address is found during a detection investigation. Which search capability is best suited for determining related endpoint activity?

1. User Search
   2. Process Timeline
   3. IP Search
   4. Hash Search

Correct Answer: 3. IP Search

Explanation:

IP Search is designed to investigate activity associated with a network address. It can help identify endpoints or events related to the suspicious IP and determine whether multiple systems communicated with it. This is particularly useful when investigating possible command-and-control infrastructure or suspicious remote services. User Search focuses on identities, Process Timeline focuses on a specific process, and Hash Search focuses on file indicators. IP Search is therefore the most direct method for obtaining network-focused context.

Question 169.

An analyst wants to show only unresolved detections with the highest severity. Which feature should be used?

1. Detection filters
   2. RTR scripts
   3. Sensor exclusions
   4. Hash Allow

Correct Answer: 1. Detection filters

Explanation:

Detection filters allow analysts to narrow detection queues using criteria such as severity, status, host, or other available attributes. Filtering for unresolved high-severity detections helps responders prioritize the most urgent activity without modifying endpoint security settings. RTR scripts execute response actions, while exclusions and hash actions change security behavior or visibility. Those features are not intended simply to organize detection results. Detection filters are therefore the correct tool for focusing attention on a specific subset of alerts during triage.

Question 170.

An analyst has already identified a suspicious process and wants a chronological view limited to activity associated with that process. Which capability should be used?

1. Host Timeline
   2. Process Timeline
   3. User Search
   4. Domain Search

Correct Answer: 2. Process Timeline

Explanation:

Process Timeline provides a focused chronological view centered on one process. It helps responders understand events associated with the suspicious executable without reviewing unrelated activity from the entire endpoint. Host Timeline provides a broader host-wide chronology, while User Search and Domain Search investigate other types of indicators. When the analyst already knows which process requires investigation, Process Timeline offers the most relevant view for examining its behavior and determining what happened around its execution.

Question 171.

A security manager wants to determine which responder performed a specific command during an RTR session. What should be reviewed?

1. Process Tree
   2. RTR audit logs
   3. Detection severity
   4. Internal prevalence

Correct Answer: 2. RTR audit logs

Explanation:

RTR audit logs provide a record of actions performed through Real Time Response. They can help security teams identify which authorized responder executed commands and support accountability, incident documentation, troubleshooting, and compliance requirements. Process Tree displays endpoint execution relationships, detection severity helps prioritize alerts, and internal prevalence indicates how common an artifact is. None of those sources identify who performed RTR actions. Audit logs are therefore the correct location for reviewing responder activity during an RTR session.

Question 172.

A threat intelligence provider supplies a long list of suspicious domains. Which capability should be used to investigate them efficiently?

1. Bulk Domain Search
   2. User Search
   3. Host Timeline
   4. Process Tree

Correct Answer: 1. Bulk Domain Search

Explanation:

Bulk Domain Search is designed for efficiently investigating multiple domain indicators. It allows responders to evaluate a collection of domains without manually searching each one through separate workflows. This is especially useful when threat intelligence identifies numerous domains associated with phishing, malware delivery, or command-and-control infrastructure. User Search focuses on identities, while Host Timeline and Process Tree focus on endpoint activity. Bulk Domain Search is therefore the most efficient capability when the investigation begins with a large list of domains.

Question 173.

A suspicious process launches multiple additional tools. Which process relationship should be examined to understand the downstream execution?

1. Parent process
   2. Child processes
   3. Host group
   4. Sensor policy

Correct Answer: 2. Child processes

Explanation:

Child processes are processes started by another process. Reviewing them helps analysts understand what occurred after a suspicious process executed. The downstream processes may reveal command shells, discovery tools, credential-access utilities, scripts, or additional malware. Parent-process analysis explains what launched the suspicious process, while host groups and sensor policies provide administrative context. When the goal is to determine what a suspicious executable launched afterward, child-process relationships provide the most relevant evidence.

Question 174.

A responder confirms that a file is trusted software and should be permitted to execute. Which hash-management action should be chosen?

1. Block
   2. Detect Only
   3. Allow
   4. Block and Hide Detection

Correct Answer: 3. Allow

Explanation:

Allow is appropriate when a file has been verified as trusted and should execute normally according to organizational policy. The responder should confirm the file and hash carefully because allowing malicious content could reduce protection. Block prevents execution, while Detect Only continues monitoring without the same prevention action. Block and Hide Detection is intended for a different combination of prevention and visibility behavior. For confirmed legitimate software that should be permitted, Allow is the correct hash-management choice.

Question 175.

An analyst needs to search detailed event telemetry after identifying suspicious behavior in a detection. Which capability should be used?

1. Event Advanced Search
   2. Host group creation
   3. User role configuration
   4. Sensor update settings

Correct Answer: 1. Event Advanced Search

Explanation:

Event Advanced Search allows responders to investigate detailed enterprise telemetry beyond the information initially displayed in a detection. Analysts can search for related events, refine results, and uncover additional evidence that may help determine incident scope or reconstruct attack activity. Host groups, user roles, and sensor update settings are administrative features and do not provide detailed event-search functionality. Event Advanced Search is therefore the appropriate choice when deeper telemetry analysis is required during an investigation.

Question 176.

An application has been confirmed as legitimate but repeatedly causes unwanted detections. What should the responder do before applying an exclusion?

1. Exclude the entire endpoint
   2. Disable all prevention features
   3. Verify the behavior and use the narrowest suitable exclusion
   4. Ignore all future detections

Correct Answer: 3. Verify the behavior and use the narrowest suitable exclusion

Explanation:

Before applying an exclusion, the responder should confirm that the activity is legitimate and understand how the exclusion will affect detection, prevention, or visibility. The scope should be kept as narrow as possible to avoid creating unnecessary blind spots. Excluding an entire endpoint or disabling prevention would significantly weaken security. Ignoring future detections could also allow unrelated malicious activity to go unnoticed. Careful validation and minimal scoping help reduce false positives while maintaining the strongest practical level of security coverage.

Question 177.

In MITRE ATT&CK, which component represents the method an adversary uses to achieve a goal?

1. Tactic
   2. Technique
   3. Detection status
   4. Host policy

Correct Answer: 2. Technique

Explanation:

A technique in MITRE ATT&CK describes a method or behavior adversaries use to accomplish an objective. Tactics represent the broader objectives, such as Execution, Persistence, Credential Access, or Discovery. Techniques explain how attackers may achieve those goals. Understanding the relationship between tactics and techniques helps analysts interpret detection context and map suspicious activity into a broader attack sequence. Detection status and host policies are separate concepts and are not ATT&CK components that describe adversary behavior.

Question 178.

A response team frequently performs the same sequence of approved RTR commands. What is the best method for making the procedure reusable?

1. Create an RTR custom script
   2. Create a sensor exclusion
   3. Change the detection severity
   4. Create a host group

Correct Answer: 1. Create an RTR custom script

Explanation:

An RTR custom script allows a repeatable set of approved commands to be packaged into a reusable response workflow. This improves consistency and reduces manual command-entry errors during recurring remediation tasks. Scripts should be tested and restricted to authorized responders because they may perform significant actions on endpoints. Sensor exclusions affect visibility, while changing severity or creating host groups does not execute remediation commands. A custom RTR script is therefore the most appropriate option for standardizing recurring response procedures.

Question 179.

An analyst wants to determine whether suspicious behavior found on one system is also present elsewhere. Which approach is most effective?

1. Review only the original alert
   2. Correlate hosts, processes, users, hashes, domains, and IP addresses
   3. Immediately close the detection
   4. Disable logging on other systems

Correct Answer: 2. Correlate hosts, processes, users, hashes, domains, and IP addresses

Explanation:

Incident scoping requires correlating multiple sources of evidence. The analyst should review hosts, processes, user accounts, file hashes, domains, IP addresses, timelines, and related event data to determine whether the same activity exists elsewhere. Reviewing only the original alert can miss connected compromise, while closing the detection prematurely may leave malicious activity unresolved. Disabling logging would reduce visibility. Correlating multiple evidence types provides a more complete picture of the incident and helps establish whether the compromise is isolated or widespread.

Question 180.

A suspicious executable creates several scripts and command-line tools. What should the analyst investigate next?

1. Subscription information
   2. Console appearance
   3. Host naming standards
   4. Child processes and associated events

Correct Answer: 4. Child processes and associated events

Explanation:

Child processes and associated events reveal what the suspicious executable did after it started. They may expose additional payloads, scripts, system utilities, reconnaissance commands, credential-access behavior, or persistence activity. Reviewing these relationships helps the analyst reconstruct the attack sequence and determine what additional response may be necessary. Subscription information, console appearance, and host naming standards do not explain endpoint behavior. Examining child processes and related activity is therefore the most appropriate next investigative step.