View Full CrowdStrike CCFR-201 Exam Dumps and Practice Test Dumps

 

Question 301.

An analyst observes a suspicious PowerShell process and wants to identify the application that launched it. Which relationship should be examined first?

1. Parent process
   2. Child process
   3. Host group
   4. Sensor policy

Correct Answer: 1. Parent process

Explanation:

The parent process identifies the process that directly launched another process. Reviewing it helps the analyst determine how suspicious execution began and can reveal unusual relationships, such as an office application or browser unexpectedly starting PowerShell. Child processes show what PowerShell launched afterward, while host groups and sensor policies provide administrative information rather than execution context. Examining the parent process is therefore the most direct method for identifying the origin of suspicious process activity and reconstructing the beginning of the execution chain.

Question 302.

A responder has identified the SHA-256 hash of a suspicious executable and wants to find other endpoints where it appeared. Which capability should be used?

1. User Search
   2. Hash Search
   3. IP Search
   4. Process Timeline

Correct Answer: 2. Hash Search

Explanation:

Hash Search is designed to investigate a known file hash across the environment. It can help identify additional endpoints where the same file has appeared and support incident scoping. User Search focuses on identities, IP Search focuses on network addresses, and Process Timeline investigates activity associated with one process. When the known indicator is a SHA-256 hash, Hash Search provides the most direct approach for locating related file activity and determining whether the suspicious executable is isolated or more widely distributed.

Question 303.

An analyst wants a chronological view of all relevant endpoint activity surrounding a detection. Which capability is most appropriate?

1. Hash management
   2. User Search
   3. Host Timeline
   4. Detection grouping

Correct Answer: 3. Host Timeline

Explanation:

Host Timeline provides a chronological view of activity across an endpoint. It helps analysts reconstruct what happened before, during, and after suspicious behavior and may reveal related events that were not obvious from the original detection. Hash management controls file actions, User Search focuses on identities, and detection grouping organizes detections. When the analyst requires broad time-based context across an entire endpoint, Host Timeline provides the most appropriate investigative view.

Question 304.

An authorized responder needs to remotely inspect a compromised endpoint and execute remediation commands. Which capability should be used?

1. Bulk Domain Search
   2. Detection filtering
   3. User Search
   4. Real Time Response

Correct Answer: 4. Real Time Response

Explanation:

Real Time Response enables authorized responders to interact directly with supported endpoints during investigations. Through RTR, they can execute approved commands, inspect files, gather evidence, and perform remediation remotely. Bulk Domain Search investigates domain indicators, detection filtering organizes alerts, and User Search focuses on identities. None of those features provides direct endpoint interaction. Because RTR can perform powerful actions, access should be carefully controlled and responder activity should be reviewed through appropriate audit records.

Question 305.

A newly observed executable appears on only one workstation in a large organization. Which concept best describes this observation?

1. Internal prevalence
   2. Detection severity
   3. User privilege
   4. Host containment

Correct Answer: 1. Internal prevalence

Explanation:

Internal prevalence describes how commonly an artifact appears within the organization’s environment. A file found on only one endpoint has low internal prevalence and may justify additional investigation, particularly when combined with suspicious behavior. Low prevalence alone does not prove that a file is malicious, so analysts should also examine process activity, reputation, network connections, and related detections. Detection severity, user privileges, and containment status represent different security concepts and do not measure how widely a file appears internally.

Question 306.

A file hash has been confirmed as malicious and should be prevented from executing. Which action should be selected?

1. Allow
   2. Block
   3. Detect Only
   4. No action

Correct Answer: 2. Block

Explanation:

Block is appropriate when a file hash has been confirmed as malicious and the organization wants to prevent the associated file from executing. Detect Only provides monitoring without the same prevention effect, while Allow is intended for trusted software. No action would not satisfy the requirement. Responders should carefully validate the hash before applying a block to avoid disrupting legitimate applications. Hash-management actions should reflect the organization’s confidence in the evidence and the intended security outcome.

Question 307.

An investigation begins with a username suspected of being involved in malicious activity. Which capability should be used first?

1. User Search
   2. Hash Search
   3. IP Search
   4. Process Tree

Correct Answer: 1. User Search

Explanation:

User Search is the appropriate starting point when an investigation centers on a specific account. It can help responders identify activity and systems associated with that identity and provide context for further pivots into detections, processes, hosts, or network indicators. Hash Search focuses on files, IP Search focuses on network addresses, and Process Tree focuses on execution relationships. When the known starting indicator is a username, User Search provides the most direct identity-focused investigative approach.

Question 308.

A suspicious external IP address appears in endpoint telemetry. Which capability should the analyst use to investigate related communications?

1. Hash Search
   2. User Search
   3. IP Search
   4. Process Timeline

Correct Answer: 3. IP Search

Explanation:

IP Search is intended for investigations involving network addresses. It can help identify endpoint activity associated with a suspicious IP and determine whether multiple systems communicated with the address. This is useful when investigating command-and-control infrastructure or suspicious remote services. Hash Search focuses on files, User Search focuses on identities, and Process Timeline focuses on a process. IP Search therefore provides the most relevant network-centered investigative context.

Question 309.

An analyst wants to focus a large detection queue on unresolved critical detections. Which feature should be used?

1. Detection filters
   2. RTR custom scripts
   3. Sensor exclusions
   4. Hash Allow

Correct Answer: 1. Detection filters

Explanation:

Detection filters allow responders to narrow large queues using criteria such as severity, status, host, or other available attributes. Filtering for unresolved critical detections makes triage more efficient and helps analysts prioritize the most urgent activity. RTR scripts execute response actions, sensor exclusions can reduce visibility, and hash actions modify file handling. None of those capabilities is intended simply to organize detection results. Filtering is therefore the correct approach for focusing on a high-priority subset of detections.

Question 310.

An analyst wants to investigate events associated with one suspicious executable without reviewing unrelated host activity. Which capability should be selected?

1. Host Timeline
   2. Process Timeline
   3. User Search
   4. Bulk Domain Search

Correct Answer: 2. Process Timeline

Explanation:

Process Timeline provides a chronological view centered on one process and its associated events. It is useful when the analyst has already identified a suspicious executable and wants to investigate its behavior without reviewing unrelated activity across the entire endpoint. Host Timeline provides broader endpoint context, while User Search and Bulk Domain Search focus on different indicator types. Process Timeline therefore offers the most focused view for understanding activity directly related to a specific suspicious process.

Question 311.

A security manager wants to determine which responder executed commands during a Real Time Response session. Which records should be reviewed?

1. RTR audit logs
   2. Internal prevalence
   3. Process Tree
   4. Detection severity

Correct Answer: 1. RTR audit logs

Explanation:

RTR audit logs provide records of actions performed during Real Time Response sessions. They can help determine which authorized responder executed specific commands and support accountability, incident documentation, troubleshooting, and compliance. Internal prevalence measures how common an artifact is, Process Tree shows execution relationships, and detection severity helps prioritize alerts. None of those sources provides the administrative audit trail associated with RTR activity. Reviewing RTR audit logs is therefore the appropriate method for verifying responder actions.

Question 312.

A threat intelligence feed contains many suspicious domains. Which capability is best suited for investigating them efficiently?

1. Bulk Domain Search
   2. Host Timeline
   3. User Search
   4. Process Tree

Correct Answer: 1. Bulk Domain Search

Explanation:

Bulk Domain Search is designed for investigations involving multiple domain indicators. It allows responders to evaluate many suspicious domains more efficiently than searching each one individually. This is particularly useful when threat intelligence provides lists associated with phishing, malware delivery, or command-and-control infrastructure. Host Timeline and Process Tree focus on endpoint behavior, while User Search focuses on identity activity. Bulk Domain Search is therefore the most efficient capability for investigating a large collection of domains.

Question 313.

A suspicious process launches a command shell, scripts, and several system utilities. Which relationship should the analyst review to understand downstream execution?

1. Parent process
   2. Child processes
   3. Host group
   4. Sensor policy

Correct Answer: 2. Child processes

Explanation:

Child processes show which processes were launched by another process. Reviewing them helps analysts understand what occurred after the suspicious process started and may expose command shells, scripts, reconnaissance tools, credential-access utilities, or additional payloads. The parent process explains what launched the original process, while host groups and sensor policies provide administrative context. Child-process analysis is therefore the appropriate approach for understanding downstream execution activity and reconstructing an attack chain.

Question 314.

A responder confirms that a file belongs to trusted enterprise software and should be permitted to execute. Which hash-management action is appropriate?

1. Block
   2. Detect Only
   3. Allow
   4. Block and Hide Detection

Correct Answer: 3. Allow

Explanation:

Allow is appropriate when a file has been verified as trusted and should execute normally according to organizational policy. The responder should carefully validate the file and hash before applying this action because mistakenly allowing malicious content could weaken security. Block prevents execution, while Detect Only provides monitoring without the same prevention behavior. Block and Hide Detection has a different prevention and visibility outcome. For confirmed legitimate software, Allow is the appropriate hash-management action.

Question 315.

An analyst wants to search detailed enterprise event telemetry related to an existing detection. Which capability should be used?

1. Event Advanced Search
   2. Host group configuration
   3. Sensor update policy
   4. User role management

Correct Answer: 1. Event Advanced Search

Explanation:

Event Advanced Search enables responders to investigate detailed telemetry beyond what is initially shown in a detection. Analysts can search for related events, refine results, and uncover additional evidence that may help determine the scope and sequence of suspicious activity. Host groups, sensor policies, and user roles are administrative capabilities rather than investigative search tools. When deeper event-level analysis is required, Event Advanced Search provides the appropriate functionality for expanding an investigation.

Question 316.

A legitimate application repeatedly produces unwanted detections. Which approach should guide creation of an exclusion?

1. Exclude the entire host
   2. Disable all prevention controls
   3. Verify the behavior and use the narrowest effective exclusion
   4. Ignore all future alerts from the application

Correct Answer: 3. Verify the behavior and use the narrowest effective exclusion

Explanation:

Before creating an exclusion, the analyst should verify that the activity is genuinely legitimate and understand how the exclusion type will affect detection, prevention, or telemetry. The exclusion should be scoped as narrowly as possible to minimize security blind spots. Excluding an entire host or disabling prevention would significantly weaken protection. Ignoring future alerts could also hide unrelated malicious activity. A carefully validated and narrowly scoped exclusion provides the best balance between reducing false positives and maintaining security visibility.

Question 317.

Within MITRE ATT&CK, what does a technique represent?

1. A high-level adversary objective
   2. A method used to achieve an adversary objective
   3. A detection severity level
   4. A host configuration policy

Correct Answer: 2. A method used to achieve an adversary objective

Explanation:

A technique in MITRE ATT&CK describes a method or behavior adversaries use to achieve a broader objective. Tactics represent the high-level objectives, such as Execution, Persistence, Credential Access, or Discovery. Techniques explain how attackers may accomplish those goals. Understanding the relationship between tactics and techniques helps responders interpret ATT&CK mappings and connect observed behavior to a larger attack sequence. Detection severity and host configuration policies are separate operational concepts and do not represent adversary methods.

Question 318.

A response team wants to reuse the same approved sequence of RTR commands during recurring incidents. What should be created?

1. An RTR custom script
   2. A sensor visibility exclusion
   3. A detection filter
   4. A host group

Correct Answer: 1. An RTR custom script

Explanation:

An RTR custom script allows a frequently used sequence of approved commands to be packaged into a reusable response workflow. This improves consistency, reduces manual command-entry errors, and can make recurring remediation procedures more efficient. Scripts should be tested carefully and restricted to authorized responders because they may perform significant endpoint actions. Sensor exclusions affect visibility, detection filters organize alerts, and host groups organize endpoints. An RTR custom script is therefore the most appropriate solution for standardizing repeated response actions.

Question 319.

An analyst suspects that suspicious activity on one endpoint may also exist elsewhere in the environment. Which strategy is most appropriate?

1. Review only the original alert
   2. Correlate hosts, users, processes, hashes, domains, and IP addresses
   3. Close the detection immediately
   4. Disable telemetry on unaffected systems

Correct Answer: 2. Correlate hosts, users, processes, hashes, domains, and IP addresses

Explanation:

Determining incident scope requires correlating multiple forms of evidence across the environment. Analysts should examine related hosts, users, processes, file hashes, domains, IP addresses, timelines, and event data. This can reveal additional affected systems or accounts and help determine whether suspicious activity extends beyond the original endpoint. Reviewing only one alert can miss connected activity, while disabling telemetry reduces visibility. Correlating several evidence types provides a stronger basis for understanding the complete scope of an incident.

Question 320.

A suspicious executable launches scripts, network utilities, and multiple additional processes. What should the analyst review next?

1. Subscription information
   2. Console appearance settings
   3. Host naming conventions
   4. Child processes and related events

Correct Answer: 4. Child processes and related events

Explanation:

Child processes and related events reveal what occurred after the suspicious executable began running. Reviewing them may expose reconnaissance commands, credential-access activity, persistence attempts, additional payloads, or other potentially malicious behavior. This information helps the analyst reconstruct the attack chain and determine whether further investigation or remediation is required. Subscription information, console appearance settings, and host naming conventions do not explain endpoint execution behavior. Examining downstream process activity and related events is therefore the most appropriate next investigative step.