View Full CrowdStrike CCFR-201 Exam Dumps and Practice Test Dumps

 

Question 221.

An analyst wants to determine which process directly launched a suspicious PowerShell instance. Which process relationship should be examined first?

1. Parent process
   2. Child process
   3. Host group
   4. Sensor policy

Correct Answer: 1. Parent process

Explanation:

The parent process identifies the process that directly launched another process. Reviewing it helps the analyst understand how suspicious execution began and may reveal abnormal relationships, such as a document application or browser unexpectedly starting PowerShell. Child processes show what PowerShell launched afterward, while host groups and sensor policies provide administrative context rather than execution details. Examining the parent process is therefore the most direct way to identify the source of suspicious process activity and begin reconstructing the execution chain.

Question 222.

A responder has identified a suspicious file hash and wants to determine whether the same file appears elsewhere in the environment. Which capability should be used?

1. User Search
   2. Hash Search
   3. IP Search
   4. Process Timeline

Correct Answer: 2. Hash Search

Explanation:

Hash Search is appropriate when the investigation begins with a known file hash. It can help responders identify additional endpoints where the same file has appeared and determine whether suspicious activity is isolated or widespread. User Search focuses on accounts, IP Search investigates network addresses, and Process Timeline focuses on one process. When the known indicator is a file hash, Hash Search provides the most direct method for locating related systems and gathering context about the artifact’s presence across the environment.

Question 223.

An analyst wants to reconstruct endpoint activity in chronological order before and after a suspicious detection. Which capability is most appropriate?

1. Hash management
   2. User Search
   3. Host Timeline
   4. Detection sorting

Correct Answer: 3. Host Timeline

Explanation:

Host Timeline provides a chronological view of activity across an endpoint. It helps responders reconstruct events that occurred before, during, and after suspicious behavior and may reveal related activity that was not immediately visible in the original detection. Hash management controls file actions, User Search focuses on identity information, and detection sorting organizes alerts. When an investigation requires broad time-based context for an entire endpoint, Host Timeline is the most appropriate capability.

Question 224.

An authorized responder needs to inspect files and execute approved commands remotely on a compromised endpoint. Which capability should be used?

1. Bulk Domain Search
   2. Detection filters
   3. Real Time Response
   4. User Search

Correct Answer: 3. Real Time Response

Explanation:

Real Time Response allows authorized responders to interact directly with supported endpoints during an investigation. Through RTR, the analyst can execute approved commands, inspect files, gather evidence, and perform remediation actions remotely. Bulk Domain Search investigates domains, detection filters organize alerts, and User Search focuses on account activity. None of those capabilities provides direct endpoint interaction. Because RTR can affect systems and files, organizations should restrict permissions carefully and review activity through appropriate audit records.

Question 225.

A file is seen on nearly every endpoint in the organization. Which investigative factor is being evaluated?

1. Internal prevalence
   2. Detection severity
   3. User privilege
   4. Host containment status

Correct Answer: 1. Internal prevalence

Explanation:

Internal prevalence describes how common an artifact is within the organization’s own environment. A file observed on nearly every endpoint has high internal prevalence. This can provide useful context, although prevalence alone does not prove that a file is safe or malicious. Analysts should combine it with process behavior, reputation, related detections, and network activity. Detection severity, user privilege, and containment status provide different forms of context and do not measure how widespread a file is across enterprise systems.

Question 226.

A responder wants Falcon to identify activity involving a hash but does not want to apply execution blocking. Which hash-management action best fits the requirement?

1. Allow
   2. Detect Only
   3. Block
   4. Block and Hide Detection

Correct Answer: 2. Detect Only

Explanation:

Detect Only is appropriate when the organization wants to maintain visibility into activity involving a particular hash without applying the same prevention behavior as a Block action. This can be useful while gathering more evidence or monitoring an artifact. Allow is intended for trusted files, while Block prevents execution under applicable controls. Block and Hide Detection produces a different combination of prevention and visibility behavior. The selected hash action should match the organization’s confidence level and intended security outcome.

Question 227.

An analyst is investigating suspicious activity associated with a particular username. Which capability provides the most direct starting point?

1. User Search
   2. Hash Search
   3. IP Search
   4. Process Tree

Correct Answer: 1. User Search

Explanation:

User Search is designed for investigations centered on a particular account or username. It can help the analyst identify activity and systems associated with that identity and provide a starting point for further pivots into detections, processes, hosts, or network indicators. Hash Search focuses on files, IP Search investigates network addresses, and Process Tree visualizes execution relationships. When the known indicator is a username, User Search provides the most direct and relevant investigative perspective.

Question 228.

A suspicious external IP address is found in a detection. Which capability should be used to determine whether other systems communicated with it?

1. Process Timeline
   2. Hash Search
   3. IP Search
   4. User Search

Correct Answer: 3. IP Search

Explanation:

IP Search is intended for investigations involving network addresses. It can help identify endpoints or events associated with the suspicious IP and determine whether multiple systems communicated with it. This is valuable when investigating potential command-and-control infrastructure or suspicious remote services. Process Timeline focuses on a process, Hash Search focuses on files, and User Search focuses on identities. When the indicator is an IP address, IP Search provides the most direct route to relevant network context.

Question 229.

An analyst needs to focus a large detection queue on unresolved high-severity items. Which functionality should be used?

1. Detection filtering
   2. RTR scripting
   3. Hash Allow
   4. Sensor exclusion creation

Correct Answer: 1. Detection filtering

Explanation:

Detection filtering allows responders to narrow a large queue according to criteria such as severity, status, host, or other available attributes. This makes it easier to prioritize high-risk unresolved detections without changing endpoint security settings. RTR scripts perform response actions, while hash actions and exclusions modify security behavior or visibility. Those capabilities are not intended simply to organize alerts. Filtering is therefore the correct approach when the analyst needs to focus on a specific subset of detections during triage.

Question 230.

An analyst has identified one suspicious executable and wants a chronological view focused specifically on that process. Which capability should be selected?

1. Host Timeline
   2. Process Timeline
   3. User Search
   4. Bulk Domain Search

Correct Answer: 2. Process Timeline

Explanation:

Process Timeline provides a chronological view centered on one process and its associated activity. It is useful when the analyst already knows which executable requires investigation and wants to avoid unrelated host events. Host Timeline provides broader endpoint context, while User Search and Bulk Domain Search focus on different types of indicators. A process-centered timeline helps responders understand the behavior of the suspicious executable and identify events directly associated with its execution.

Question 231.

A security manager wants to verify which responder ran a command during a Real Time Response session. Which source should be reviewed?

1. RTR audit logs
   2. Internal prevalence
   3. Process Tree
   4. Detection severity

Correct Answer: 1. RTR audit logs

Explanation:

RTR audit logs provide records of actions performed during Real Time Response sessions. They help security teams determine which authorized responder executed particular commands and support accountability, incident documentation, compliance, and troubleshooting. Internal prevalence measures how common an artifact is, Process Tree shows execution relationships, and detection severity helps prioritize alerts. None of those sources provides the same administrative audit trail. RTR audit logs are therefore the appropriate place to verify responder actions.

Question 232.

A threat intelligence report provides a large list of suspicious domains. Which capability should be used to investigate them efficiently?

1. Bulk Domain Search
   2. User Search
   3. Host Timeline
   4. Process Tree

Correct Answer: 1. Bulk Domain Search

Explanation:

Bulk Domain Search is designed for investigating multiple domain indicators efficiently. It allows analysts to check a collection of suspicious domains rather than manually searching them one at a time. This is especially useful when threat intelligence identifies potential phishing, malware-delivery, or command-and-control infrastructure. User Search focuses on accounts, while Host Timeline and Process Tree focus on endpoint activity. Bulk Domain Search is therefore the most appropriate option when working with a large list of domain indicators.

Question 233.

A suspicious executable starts several command-line utilities after it launches. Which process relationship should the analyst review to understand this downstream activity?

1. Parent process
   2. Child processes
   3. Host group
   4. Sensor version

Correct Answer: 2. Child processes

Explanation:

Child processes are the processes started by another process. Reviewing them helps the analyst understand what occurred after the suspicious executable began running. The downstream processes may include command shells, discovery utilities, scripts, credential-related tools, or additional payloads. The parent process explains what launched the suspicious executable but not what it launched afterward. Host groups and sensor versions provide administrative context. Child-process analysis is therefore the correct approach for understanding downstream execution behavior.

Question 234.

A responder has verified that an executable belongs to trusted business software and should be permitted. Which hash-management action should be selected?

1. Block
   2. Detect Only
   3. Allow
   4. Block and Hide Detection

Correct Answer: 3. Allow

Explanation:

Allow is appropriate when a file has been verified as trusted and should execute normally according to organizational policy. The responder should carefully validate the hash and file identity before applying the action because mistakenly allowing malicious content could reduce protection. Block prevents execution, while Detect Only provides monitoring without the same blocking behavior. Block and Hide Detection has a different prevention and visibility outcome. For confirmed legitimate software that should be permitted, Allow is the appropriate hash-management action.

Question 235.

An analyst wants to investigate detailed telemetry related to a detection across the environment. Which capability should be used?

1. Event Advanced Search
   2. Host group configuration
   3. Sensor update policy
   4. User role management

Correct Answer: 1. Event Advanced Search

Explanation:

Event Advanced Search allows analysts to investigate detailed enterprise telemetry beyond the information shown in an individual detection. It can be used to search for related activity, refine results, and uncover additional evidence that may help determine the scope and sequence of suspicious behavior. Host groups, sensor policies, and user roles are administrative capabilities rather than investigative search tools. Event Advanced Search is therefore the appropriate choice when deeper event analysis is required.

Question 236.

An analyst plans to create an exclusion for confirmed legitimate activity. Which practice provides the best balance between usability and security?

1. Exclude the entire endpoint
   2. Disable all prevention controls
   3. Use the narrowest effective exclusion scope
   4. Ignore future alerts from the application

Correct Answer: 3. Use the narrowest effective exclusion scope

Explanation:

Exclusions can reduce detection, prevention, or visibility, so they should be scoped as narrowly as possible. The analyst should first confirm that the activity is legitimate and then select the exclusion type and scope that resolve the problem without unnecessarily suppressing unrelated security information. Excluding an entire endpoint or disabling prevention would significantly weaken protection. Ignoring future alerts could also hide unrelated malicious behavior. A narrow, carefully validated exclusion provides the strongest balance between reducing false positives and maintaining security coverage.

Question 237.

Which MITRE ATT&CK concept represents a specific method adversaries use to achieve an objective?

1. Tactic
   2. Technique
   3. Detection status
   4. Host policy

Correct Answer: 2. Technique

Explanation:

A technique in MITRE ATT&CK describes a method or behavior adversaries use to accomplish a broader objective. Tactics represent the higher-level goals, such as Execution, Persistence, Credential Access, or Discovery. Techniques explain how attackers may pursue those goals. Understanding this relationship helps analysts interpret ATT&CK mappings and connect suspicious behavior to a broader attack sequence. Detection status and host policies are separate operational concepts and do not describe adversary methods within the ATT&CK framework.

Question 238.

A response team wants to reuse the same approved sequence of commands during multiple RTR investigations. What should be created?

1. An RTR custom script
   2. A detection filter
   3. A sensor exclusion
   4. A host group

Correct Answer: 1. An RTR custom script

Explanation:

An RTR custom script allows a repeatable set of approved commands to be packaged into a reusable response procedure. This helps improve consistency, reduces manual command-entry errors, and can make recurring remediation tasks more efficient. Custom scripts should be tested and limited to authorized responders because they may perform significant endpoint actions. Detection filters organize alerts, sensor exclusions affect visibility, and host groups organize endpoints. None of those features standardizes command execution in the way an RTR custom script does.

Question 239.

An analyst wants to determine whether suspicious behavior discovered on one host is part of a wider incident. Which approach is most appropriate?

1. Review only the original alert
   2. Correlate related hosts, users, processes, hashes, domains, and IP addresses
   3. Close the detection immediately
   4. Disable telemetry on unaffected endpoints

Correct Answer: 2. Correlate related hosts, users, processes, hashes, domains, and IP addresses

Explanation:

Determining incident scope requires correlating multiple sources of evidence across the environment. The analyst should investigate related hosts, users, processes, file hashes, domains, IP addresses, timelines, and event data. This can reveal whether the same behavior or indicators appear elsewhere. Reviewing only the original alert may miss connected compromise, while closing the detection too early could leave malicious activity unresolved. Disabling telemetry would reduce visibility. Correlating several evidence types provides a stronger basis for understanding the full incident scope.

Question 240.

A suspicious process launches scripts, network utilities, and additional executables. What should the analyst review next to understand the subsequent behavior?

1. Subscription settings
   2. Console display options
   3. Host naming standards
   4. Child processes and related events

Correct Answer: 4. Child processes and related events

Explanation:

Child processes and related events show what occurred after the suspicious process started. Reviewing them may expose reconnaissance commands, credential-access attempts, persistence mechanisms, additional payloads, or other malicious activity. This information helps the analyst reconstruct the attack chain and determine what further investigation or remediation may be required. Subscription settings, console display options, and host naming standards do not explain endpoint behavior. Examining downstream process activity and related events is therefore the most appropriate next investigative step.