View Full CrowdStrike CCFR-201 Exam Dumps and Practice Test Dumps

Question 321.

An analyst sees a suspicious process created by an unexpected application and wants to trace the origin of execution. Which relationship should be reviewed first?

1. Parent process
   2. Child process
   3. Host group
   4. Sensor policy

Correct Answer: 1. Parent process

Explanation:

The parent process identifies the process that directly launched another process. Reviewing it helps the analyst determine how suspicious execution began and can expose unusual relationships, such as a browser or office application starting a command interpreter. Child processes show what was launched afterward, while host groups and sensor policies provide administrative context rather than execution details. Examining the parent process is therefore the most direct way to identify the source of suspicious process activity and begin reconstructing the execution chain.

Question 322.

A responder has a suspicious file hash and wants to identify every endpoint where the file has appeared. Which capability is most appropriate?

1. User Search
   2. Hash Search
   3. IP Search
   4. Process Timeline

Correct Answer: 2. Hash Search

Explanation:

Hash Search is designed for investigations involving a known file hash. It can help responders identify additional endpoints where the same file has appeared and determine whether suspicious activity is isolated or widespread. User Search focuses on identities, IP Search focuses on network addresses, and Process Timeline examines activity associated with a particular process. When a file hash is the known indicator, Hash Search provides the most direct method for locating related systems and expanding the investigation.

Question 323.

An analyst wants to reconstruct activity across an endpoint in chronological order during a suspected intrusion. Which capability should be used?

1. Process Tree
   2. User Search
   3. Host Timeline
   4. Hash management

Correct Answer: 3. Host Timeline

Explanation:

Host Timeline provides a chronological view of activity across an endpoint. It can help responders understand what occurred before, during, and after suspicious behavior and reveal related events that were not obvious from the initial detection. Process Tree focuses on process relationships rather than complete host chronology. User Search focuses on account activity, while hash management controls file actions. When broad endpoint-level chronological context is required, Host Timeline is the most appropriate investigative capability.

Question 324.

An authorized responder must remotely inspect files and execute remediation commands on an affected endpoint. Which capability should be used?

1. Detection filtering
   2. Bulk Domain Search
   3. User Search
   4. Real Time Response

Correct Answer: 4. Real Time Response

Explanation:

Real Time Response allows authorized responders to interact directly with supported endpoints during an investigation. Through RTR, they can execute approved commands, inspect files, gather evidence, and perform remediation remotely. Detection filtering organizes alerts, while Bulk Domain Search and User Search provide investigative context without direct endpoint control. Because RTR can make significant changes to systems, access should be tightly controlled and actions should be auditable. RTR is therefore the appropriate capability for active remote investigation and remediation.

Question 325.

A suspicious executable appears on only one system in an enterprise containing thousands of endpoints. Which concept does this represent?

1. Internal prevalence
   2. Detection severity
   3. User privilege
   4. Host containment

Correct Answer: 1. Internal prevalence

Explanation:

Internal prevalence describes how common or rare an artifact is within the organization’s own environment. A file observed on only one endpoint has low internal prevalence and may deserve additional investigation when combined with suspicious behavior. Low prevalence alone does not prove maliciousness, so analysts should also examine process activity, reputation, network connections, and related detections. Detection severity, user privileges, and containment status provide different types of security context and do not measure how widely a file appears.

Question 326.

A confirmed malicious file must be prevented from executing. Which hash-management action should be selected?

1. Allow
   2. Block
   3. Detect Only
   4. No action

Correct Answer: 2. Block

Explanation:

Block is appropriate when a file hash has been confirmed as malicious and the organization wants to prevent the associated file from executing. Detect Only preserves visibility without applying the same prevention behavior, while Allow is intended for trusted files. No action does not satisfy the prevention requirement. Before blocking a hash, responders should validate it carefully to avoid disrupting legitimate software. The selected hash-management action should reflect both the confidence of the investigation and the desired security outcome.

Question 327.

An investigation begins with a specific username suspected of being involved in malicious activity. Which capability should be used first?

1. User Search
   2. Hash Search
   3. IP Search
   4. Process Tree

Correct Answer: 1. User Search

Explanation:

User Search is the appropriate starting point when an investigation centers on a user account. It can help responders identify activity and systems associated with that identity and provide context for further pivots into detections, processes, hosts, or network indicators. Hash Search focuses on files, IP Search focuses on network addresses, and Process Tree focuses on execution relationships. When the known indicator is a username, User Search provides the most direct identity-focused investigative path.

Question 328.

A suspicious external IP address appears in endpoint telemetry. Which capability should the analyst use to investigate related communications?

1. Hash Search
   2. User Search
   3. IP Search
   4. Process Timeline

Correct Answer: 3. IP Search

Explanation:

IP Search is designed for investigations centered on network addresses. It can help identify endpoint activity associated with a suspicious IP and determine whether multiple systems communicated with it. This is useful when investigating potential command-and-control infrastructure or suspicious remote services. Hash Search focuses on file artifacts, User Search focuses on identities, and Process Timeline focuses on a specific process. IP Search therefore provides the most relevant network-centered investigative context.

Question 329.

An analyst needs to focus a large queue on unresolved critical detections. Which functionality should be used?

1. Detection filters
   2. RTR scripts
   3. Sensor exclusions
   4. Hash Allow

Correct Answer: 1. Detection filters

Explanation:

Detection filters allow responders to narrow large detection queues using criteria such as severity, status, host, or other available properties. Filtering for unresolved critical detections makes triage more efficient and helps prioritize the highest-risk activity. RTR scripts perform endpoint response actions, while exclusions and hash actions modify security behavior or visibility. Those capabilities are not intended simply to organize alert queues. Detection filtering is therefore the correct approach for focusing on a specific high-priority subset.

Question 330.

An analyst wants a chronological view focused only on one suspicious executable. Which capability should be selected?

1. Host Timeline
   2. Process Timeline
   3. User Search
   4. Bulk Domain Search

Correct Answer: 2. Process Timeline

Explanation:

Process Timeline provides a focused chronological view centered on a specific process and its associated activity. It is useful when the analyst has already identified a suspicious executable and wants to investigate its behavior without reviewing unrelated host events. Host Timeline provides broader endpoint-wide context, while User Search and Bulk Domain Search focus on different indicator types. Process Timeline therefore offers the most targeted view for understanding the behavior of one suspicious process.

Question 331.

A security manager wants to verify which responder executed commands during an RTR session. What should be reviewed?

1. RTR audit logs
   2. Internal prevalence
   3. Process Tree
   4. Detection severity

Correct Answer: 1. RTR audit logs

Explanation:

RTR audit logs provide records of actions performed through Real Time Response. They can help identify which authorized responder executed specific commands and support accountability, incident documentation, troubleshooting, and compliance. Internal prevalence measures how common an artifact is, Process Tree shows execution relationships, and detection severity helps prioritize alerts. None of those sources provides the administrative audit trail associated with RTR activity. Reviewing RTR audit logs is therefore the appropriate method for verifying responder actions.

Question 332.

A threat intelligence feed contains many suspicious domains. Which capability is most efficient for investigating them together?

1. Bulk Domain Search
   2. Host Timeline
   3. User Search
   4. Process Tree

Correct Answer: 1. Bulk Domain Search

Explanation:

Bulk Domain Search is designed for investigations involving multiple domain indicators. It allows responders to evaluate many suspicious domains more efficiently than searching each one separately. This is particularly useful when threat intelligence provides lists associated with phishing, malware delivery, or command-and-control infrastructure. Host Timeline and Process Tree focus on endpoint activity, while User Search focuses on identities. Bulk Domain Search is therefore the most appropriate option for a large collection of domain indicators.

Question 333.

A suspicious process launches several command-line utilities, scripts, and additional executables. Which relationship should be examined to understand downstream activity?

1. Parent process
   2. Child processes
   3. Host group
   4. Sensor policy

Correct Answer: 2. Child processes

Explanation:

Child processes show which processes were launched by another process. Reviewing them helps analysts understand what happened after the suspicious process began running. Downstream processes may include command shells, scripts, system utilities, credential-access tools, or additional payloads. The parent process explains what launched the original process, while host groups and sensor policies provide administrative context. Child-process analysis is therefore essential for understanding subsequent execution behavior and reconstructing an attack chain.

Question 334.

A responder verifies that a file is trusted enterprise software and should be permitted to execute. Which hash-management action is appropriate?

1. Block
   2. Detect Only
   3. Allow
   4. Block and Hide Detection

Correct Answer: 3. Allow

Explanation:

Allow is appropriate when a file has been verified as trusted and should execute normally according to organizational policy. The responder should carefully validate the file and hash before applying this action because mistakenly allowing malicious content could weaken security. Block prevents execution, while Detect Only provides monitoring without the same prevention effect. Block and Hide Detection provides a different prevention and visibility outcome. For confirmed legitimate software, Allow is the appropriate hash-management action.

Question 335.

An analyst wants to search detailed enterprise event telemetry related to a detection. Which capability should be used?

1. Event Advanced Search
   2. Host group configuration
   3. Sensor update policy
   4. User role management

Correct Answer: 1. Event Advanced Search

Explanation:

Event Advanced Search enables responders to investigate detailed telemetry beyond the information initially displayed in a detection. Analysts can search related events, refine results, and uncover additional evidence that may help determine the scope and sequence of suspicious activity. Host groups, sensor policies, and user roles are administrative capabilities rather than investigative search tools. When deeper event-level analysis is required, Event Advanced Search provides the appropriate functionality for expanding the investigation.

Question 336.

A legitimate application repeatedly causes unwanted detections. What is the safest approach before creating an exclusion?

1. Exclude the entire endpoint
   2. Disable prevention globally
   3. Verify the behavior and use the narrowest appropriate exclusion
   4. Ignore all future alerts from the application

Correct Answer: 3. Verify the behavior and use the narrowest appropriate exclusion

Explanation:

Before creating an exclusion, the responder should verify that the activity is genuinely legitimate and understand how the exclusion type will affect detection, prevention, or visibility. The scope should be kept as narrow as possible to avoid unnecessary security blind spots. Excluding an entire endpoint or disabling prevention globally would weaken security significantly. Ignoring future alerts could also hide unrelated malicious behavior. A carefully validated and narrowly scoped exclusion provides the best balance between reducing false positives and maintaining protection.

Question 337.

Within MITRE ATT&CK, which concept represents a high-level adversary objective?

1. Tactic
   2. Technique
   3. Indicator
   4. Detection status

Correct Answer: 1. Tactic

Explanation:

A tactic in MITRE ATT&CK represents a high-level objective an adversary is attempting to achieve. Examples include Initial Access, Execution, Persistence, Credential Access, Discovery, and Exfiltration. Techniques describe the specific methods attackers use to achieve those objectives. Understanding the distinction helps responders interpret ATT&CK mappings and understand the purpose behind suspicious behavior. Indicators and detection statuses are useful security concepts but do not represent adversary objectives within the ATT&CK framework.

Question 338.

A response team wants to standardize a frequently repeated set of approved RTR commands. What should be created?

1. An RTR custom script
   2. A sensor visibility exclusion
   3. A detection filter
   4. A host group

Correct Answer: 1. An RTR custom script

Explanation:

An RTR custom script allows a repeated sequence of approved commands to be packaged into a reusable response workflow. This improves consistency, reduces manual typing errors, and can make recurring remediation procedures more efficient. Scripts should be tested and limited to authorized responders because they may perform significant endpoint actions. Sensor exclusions affect visibility, detection filters organize alerts, and host groups organize endpoints. An RTR custom script is therefore the most appropriate solution for standardizing repeated response actions.

Question 339.

An analyst suspects that suspicious activity observed on one endpoint may also exist elsewhere. Which approach is best for determining scope?

1. Review only the original detection
   2. Correlate hosts, users, processes, hashes, domains, and IP addresses
   3. Close the alert immediately
   4. Disable telemetry on unaffected endpoints

Correct Answer: 2. Correlate hosts, users, processes, hashes, domains, and IP addresses

Explanation:

Determining incident scope requires correlating multiple forms of evidence across the environment. Analysts should examine related hosts, users, processes, file hashes, domains, IP addresses, timelines, and event data. This can reveal additional affected systems or accounts and help determine whether suspicious activity extends beyond the original endpoint. Reviewing only one detection may miss connected compromise, while disabling telemetry reduces visibility. Correlating several evidence types provides a stronger basis for understanding the full scope of an incident.

Question 340.

A suspicious executable launches scripts, network utilities, and additional processes. What should the analyst review next to understand the subsequent behavior?

1. Subscription information
   2. Console appearance settings
   3. Host naming conventions
   4. Child processes and related events

Correct Answer: 4. Child processes and related events

Explanation:

Child processes and related events reveal what occurred after the suspicious executable began running. Reviewing them may expose reconnaissance commands, credential-access activity, persistence attempts, additional payloads, or other malicious behavior. This information helps the analyst reconstruct the attack sequence and determine whether further investigation or remediation is required. Subscription details, console appearance settings, and host naming conventions do not explain endpoint execution behavior. Examining downstream process activity and related events is therefore the most appropriate next investigative step.