View Full CrowdStrike CCFR-201 Exam Dumps and Practice Test Dumps

 

Question 261.

An analyst notices that a suspicious executable was launched by a document-processing application. Which information should be reviewed to confirm the execution relationship?

1. Parent process
   2. Host group membership
   3. Sensor version
   4. Detection status

Correct Answer: 1. Parent process

Explanation:

The parent process identifies the process that directly launched another process. Reviewing it helps the analyst determine how suspicious execution began and can reveal unusual combinations, such as a document-processing application launching a command shell or scripting engine. Host group membership, sensor version, and detection status can provide useful operational context but do not explain process ancestry. Examining the parent process is therefore the most appropriate way to identify the source of the suspicious executable and begin reconstructing the execution chain.

Question 262.

A responder wants to determine whether a suspicious file identified by its SHA-256 hash exists on additional endpoints. Which capability should be used?

1. User Search
   2. Hash Search
   3. IP Search
   4. Process Timeline

Correct Answer: 2. Hash Search

Explanation:

Hash Search allows responders to investigate a specific file hash across the environment. It can help identify other endpoints where the same file has appeared and support incident scoping. This is particularly useful when malware or another suspicious executable has already been identified. User Search focuses on accounts, IP Search investigates network addresses, and Process Timeline examines activity associated with one process. When the known indicator is a SHA-256 hash, Hash Search provides the most direct method for locating related file activity.

Question 263.

An analyst needs a chronological view of events across an endpoint during a suspected compromise. Which capability is most appropriate?

1. Process Tree
   2. Hash management
   3. Host Timeline
   4. User Search

Correct Answer: 3. Host Timeline

Explanation:

Host Timeline provides a chronological view of activity across an endpoint and helps analysts reconstruct events surrounding suspicious behavior. It can reveal activity that occurred before, during, and after the original detection and may expose related events not immediately visible elsewhere. Process Tree focuses on hierarchical process relationships, hash management controls file actions, and User Search focuses on identity activity. When the objective is to understand the broader sequence of endpoint events over time, Host Timeline provides the most relevant investigative context.

Question 264.

An authorized responder needs to remotely inspect a compromised host, collect evidence, and execute remediation commands. Which capability should be used?

1. Bulk Domain Search
   2. Detection filtering
   3. User Search
   4. Real Time Response

Correct Answer: 4. Real Time Response

Explanation:

Real Time Response provides authorized responders with remote endpoint interaction capabilities. Through RTR, analysts can execute supported commands, inspect files, collect information, and perform approved remediation actions without physically accessing the system. Bulk Domain Search investigates domain indicators, detection filtering organizes alerts, and User Search focuses on accounts. These features do not provide direct endpoint control. Because RTR can make significant changes to systems, access should be restricted appropriately and actions should be reviewed through audit information.

Question 265.

A newly discovered executable appears on only two systems in an organization with thousands of endpoints. Which investigative factor does this represent?

1. Internal prevalence
   2. Detection severity
   3. User role
   4. Host containment

Correct Answer: 1. Internal prevalence

Explanation:

Internal prevalence describes how common or rare an artifact is within the organization’s own environment. A file observed on only two systems has low internal prevalence, which may justify closer investigation when combined with suspicious behavior. Low prevalence alone does not prove that a file is malicious, so analysts should also review reputation, process relationships, network activity, and related detections. Detection severity, user roles, and containment status represent different security concepts and do not measure how widely a file appears internally.

Question 266.

A responder has confirmed that a file hash belongs to malware and wants to prevent the associated file from executing. Which action should be selected?

1. Allow
   2. Block
   3. Detect Only
   4. No action

Correct Answer: 2. Block

Explanation:

Block is appropriate when a file hash has been confirmed as malicious and the organization wants to prevent the associated file from executing. Detect Only provides visibility without applying the same prevention behavior, while Allow is intended for trusted files. No action would not satisfy the requirement to stop execution. Before blocking a hash, responders should verify the value carefully to avoid disrupting legitimate software. Hash-management decisions should reflect the confidence of the investigation and the desired security outcome.

Question 267.

An investigation begins with a user account suspected of participating in malicious activity. Which capability should be used first?

1. User Search
   2. Hash Search
   3. IP Search
   4. Process Tree

Correct Answer: 1. User Search

Explanation:

User Search is the most appropriate starting point when the investigation centers on a specific account. It can help responders identify activity and systems associated with that identity and provide context for pivots into detections, processes, endpoints, or network indicators. Hash Search focuses on file artifacts, IP Search focuses on network addresses, and Process Tree focuses on execution relationships. When a username is the known starting indicator, User Search provides the most direct identity-focused investigative approach.

Question 268.

A suspicious remote IP address appears in endpoint telemetry. Which capability should an analyst use to investigate activity associated with the address?

1. Hash Search
   2. User Search
   3. IP Search
   4. Process Timeline

Correct Answer: 3. IP Search

Explanation:

IP Search is designed for investigations centered on network addresses. It can help identify endpoint activity associated with a suspicious IP and determine whether the address appears in communications involving multiple systems. This is useful when investigating potential command-and-control infrastructure or suspicious remote services. Hash Search focuses on files, User Search focuses on accounts, and Process Timeline focuses on a particular process. IP Search therefore provides the most relevant network-focused context for the suspicious address.

Question 269.

An analyst has a large detection queue and wants to review only unresolved critical detections. Which feature should be used?

1. Detection filters
   2. RTR custom scripts
   3. Sensor exclusions
   4. Hash Allow

Correct Answer: 1. Detection filters

Explanation:

Detection filters allow responders to narrow a large queue using criteria such as severity, status, host, and other available attributes. Filtering for unresolved critical detections helps prioritize the most urgent items without changing endpoint security controls. RTR scripts execute response actions, sensor exclusions can reduce visibility, and hash actions modify file handling. None of those options is intended simply to organize detection results. Filtering is therefore the appropriate method for focusing on a specific high-priority subset during triage.

Question 270.

An analyst wants to examine activity associated with one suspicious executable without reviewing unrelated endpoint events. Which capability should be selected?

1. Host Timeline
   2. Process Timeline
   3. User Search
   4. Bulk Domain Search

Correct Answer: 2. Process Timeline

Explanation:

Process Timeline provides a focused chronological view centered on one process and its associated activity. It is useful when the analyst has already identified a suspicious executable and wants to investigate its behavior in detail without reviewing unrelated host events. Host Timeline provides broader endpoint-wide context, while User Search and Bulk Domain Search investigate different indicator types. Process Timeline therefore offers the most targeted view when the investigation is centered on a particular process.

Question 271.

A security manager needs to verify who executed commands during a Real Time Response session. What should be reviewed?

1. RTR audit logs
   2. Internal prevalence
   3. Process Tree
   4. Detection severity

Correct Answer: 1. RTR audit logs

Explanation:

RTR audit logs provide records of actions performed during Real Time Response sessions. They can help identify which authorized responder executed specific commands and support accountability, incident documentation, troubleshooting, and compliance. Internal prevalence measures how common an artifact is, Process Tree shows process relationships, and detection severity helps prioritize alerts. None of those sources provides an administrative record of RTR activity. Reviewing RTR audit logs is therefore the appropriate method for verifying responder actions during remote response.

Question 272.

An analyst receives a list of many suspicious domains from threat intelligence. Which capability is most efficient for investigating them together?

1. Bulk Domain Search
   2. Host Timeline
   3. User Search
   4. Process Tree

Correct Answer: 1. Bulk Domain Search

Explanation:

Bulk Domain Search is designed for investigations involving multiple domain indicators. It allows responders to evaluate a collection of suspicious domains more efficiently than searching each one individually. This is particularly useful when threat intelligence provides lists associated with phishing, malware delivery, or command-and-control infrastructure. Host Timeline and Process Tree focus on endpoint activity, while User Search focuses on identity information. Bulk Domain Search is therefore the most appropriate capability for investigating a large set of domain indicators.

Question 273.

A suspicious process launches PowerShell, a command shell, and several system utilities. Which relationship should be examined to understand what happened afterward?

1. Parent process
   2. Child processes
   3. Host group
   4. Sensor policy

Correct Answer: 2. Child processes

Explanation:

Child processes show which processes were created or launched by another process. Reviewing them helps analysts understand downstream activity that occurred after the suspicious process executed. PowerShell, command shells, and system utilities may be used for discovery, persistence, credential access, or other behaviors depending on context. The parent process identifies what launched the original process, while host groups and sensor policies provide administrative information. Child-process analysis is therefore essential for understanding subsequent execution activity.

Question 274.

A responder confirms that an executable is trusted enterprise software that should be permitted to run. Which hash-management action is most appropriate?

1. Block
   2. Detect Only
   3. Allow
   4. Block and Hide Detection

Correct Answer: 3. Allow

Explanation:

Allow is appropriate when a file has been verified as trusted and should execute normally according to organizational policy. The responder should confirm the hash carefully before applying this action because mistakenly allowing malicious content could weaken protection. Block prevents execution, while Detect Only maintains monitoring without the same prevention behavior. Block and Hide Detection produces a different prevention and visibility outcome. For confirmed legitimate software that should run normally, Allow is the appropriate hash-management action.

Question 275.

A detection shows suspicious activity, and the analyst wants to investigate related detailed telemetry across the environment. Which capability should be used?

1. Event Advanced Search
   2. Host group configuration
   3. Sensor update settings
   4. User role management

Correct Answer: 1. Event Advanced Search

Explanation:

Event Advanced Search allows analysts to investigate detailed telemetry beyond the information initially presented in a detection. It can help identify related events, refine search results, and uncover additional evidence relevant to the suspicious activity. Host groups, sensor settings, and user roles are administrative functions rather than detailed event investigation tools. When the analyst needs to broaden a detection investigation and examine enterprise telemetry in greater depth, Event Advanced Search provides the most appropriate capability.

Question 276.

A legitimate application repeatedly generates unwanted detections. What should the responder do before applying an exclusion?

1. Exclude the entire host
   2. Disable prevention globally
   3. Confirm the behavior and use the narrowest suitable exclusion
   4. Ignore all future alerts from the application

Correct Answer: 3. Confirm the behavior and use the narrowest suitable exclusion

Explanation:

Before creating an exclusion, the responder should verify that the activity is genuinely legitimate and determine how the selected exclusion type will affect detection, prevention, or visibility. The exclusion should be scoped as narrowly as possible to avoid unnecessary security blind spots. Excluding an entire host or disabling prevention globally would significantly weaken protection. Ignoring future alerts could also hide unrelated malicious behavior. A carefully validated, narrowly scoped exclusion provides the best balance between reducing false positives and maintaining security coverage.

Question 277.

In MITRE ATT&CK, which concept represents a method an adversary uses to accomplish an objective?

1. Tactic
   2. Technique
   3. Detection severity
   4. Host policy

Correct Answer: 2. Technique

Explanation:

A technique in MITRE ATT&CK represents a method or behavior an adversary uses to accomplish a broader objective. Tactics represent the high-level goals, such as Execution, Persistence, Credential Access, or Discovery. Techniques describe how attackers may achieve those goals. Understanding the relationship between tactics and techniques helps responders interpret ATT&CK mappings and connect observed behavior to an attack sequence. Detection severity and host policies are separate operational concepts and do not describe adversary methods.

Question 278.

A response team frequently performs the same approved set of commands during RTR investigations. What should be created to standardize the process?

1. An RTR custom script
   2. A sensor visibility exclusion
   3. A detection filter
   4. A host group

Correct Answer: 1. An RTR custom script

Explanation:

An RTR custom script allows a frequently used sequence of approved commands to be packaged into a reusable response workflow. This improves consistency, reduces manual command-entry errors, and can make recurring remediation procedures more efficient. Scripts should be tested and restricted to authorized responders because they may perform significant endpoint actions. Sensor exclusions affect visibility, detection filters organize alerts, and host groups organize endpoints. An RTR custom script is therefore the most appropriate solution for standardizing repeated response actions.

Question 279.

An analyst believes a suspicious detection on one host may be related to activity on other systems. Which investigation strategy is most appropriate?

1. Review only the original detection
   2. Correlate hosts, users, processes, hashes, domains, and IP addresses
   3. Close the detection after containing one host
   4. Disable telemetry on unaffected endpoints

Correct Answer: 2. Correlate hosts, users, processes, hashes, domains, and IP addresses

Explanation:

Determining incident scope requires correlating evidence across multiple systems and indicator types. The analyst should review related hosts, users, processes, file hashes, domains, IP addresses, timelines, and relevant event data. This can reveal additional affected endpoints or accounts and show whether suspicious behavior extends beyond the original system. Reviewing only the initial detection may miss connected compromise, while disabling telemetry reduces visibility. Correlating multiple evidence sources provides a stronger basis for understanding the complete scope of an incident.

Question 280.

A suspicious executable launches scripts, network tools, and several additional processes. What should the analyst review next to understand the downstream behavior?

1. Subscription information
   2. Console appearance settings
   3. Host naming standards
   4. Child processes and associated events

Correct Answer: 4. Child processes and associated events

Explanation:

Child processes and associated events reveal what occurred after the suspicious executable started. Reviewing them may identify scripts, additional payloads, reconnaissance tools, credential-access behavior, persistence attempts, or other suspicious actions. This information helps the analyst reconstruct the attack sequence and determine whether additional response or remediation is required. Subscription information, console appearance settings, and host naming standards do not explain endpoint execution behavior. Examining downstream process activity and related events is therefore the most appropriate next investigative step.