View Full CrowdStrike CCFR-201 Exam Dumps and Practice Test Dumps

 

Question 381.

An analyst discovers that a suspicious executable was launched by a web browser. Which relationship should be examined first to understand the origin of execution?

1. Parent process
   2. Child process
   3. Host group
   4. Sensor policy

Correct Answer: 1. Parent process

Explanation:

The parent process identifies the process that directly launched another process. Reviewing this relationship helps an analyst understand how suspicious execution began and can reveal unusual behavior, such as a browser unexpectedly starting a command-line tool or scripting engine. Child processes show what the suspicious executable launched afterward, while host groups and sensor policies provide administrative context rather than execution details. Examining the parent process is therefore the most appropriate first step when reconstructing the initial stage of suspicious process activity.

Question 382.

A responder wants to determine whether a suspicious file identified by its hash has appeared on other endpoints. Which capability should be used?

1. User Search
   2. Hash Search
   3. IP Search
   4. Process Timeline

Correct Answer: 2. Hash Search

Explanation:

Hash Search is intended for investigations that begin with a known file hash. It can help responders identify additional endpoints where the same file has appeared and determine whether suspicious activity is isolated or widespread. User Search focuses on identities, IP Search focuses on network addresses, and Process Timeline focuses on activity associated with a specific process. When a file hash is the known indicator, Hash Search provides the most direct method for locating related systems and expanding the investigation.

Question 383.

An analyst needs a chronological view of endpoint activity before and after a suspicious event. Which capability should be selected?

1. Process Tree
   2. User Search
   3. Host Timeline
   4. Hash management

Correct Answer: 3. Host Timeline

Explanation:

Host Timeline provides a chronological view of activity across an endpoint. It can help analysts reconstruct events that occurred before, during, and after suspicious behavior and identify related activity that may not have been obvious from the original detection. Process Tree focuses on hierarchical process relationships, while User Search and hash management serve different purposes. When broad endpoint-level chronological context is required, Host Timeline is the most appropriate investigative capability.

Question 384.

An authorized responder must remotely inspect files and execute approved remediation commands on a compromised system. Which capability should be used?

1. Detection filtering
   2. Bulk Domain Search
   3. User Search
   4. Real Time Response

Correct Answer: 4. Real Time Response

Explanation:

Real Time Response enables authorized responders to interact directly with supported endpoints. Through RTR, they can execute approved commands, inspect files, gather evidence, and perform remediation remotely. Detection filtering organizes alerts, while Bulk Domain Search and User Search provide investigative context without direct endpoint control. Because RTR can perform significant actions on systems, access should be restricted appropriately and activity should be auditable. RTR is therefore the correct capability for active remote investigation and remediation.

Question 385.

A suspicious executable appears on only one endpoint in a very large enterprise. Which concept does this observation describe?

1. Internal prevalence
   2. Detection severity
   3. Host containment
   4. User privilege

Correct Answer: 1. Internal prevalence

Explanation:

Internal prevalence describes how common or rare an artifact is within the organization’s own environment. A file observed on only one endpoint has low internal prevalence and may deserve additional investigation when combined with suspicious behavior. Low prevalence alone does not prove maliciousness, so analysts should also consider process activity, reputation, network connections, and related detections. Detection severity, containment status, and user privileges describe different security properties and do not measure how widely a file appears.

Question 386.

A confirmed malicious file must be prevented from executing. Which hash-management action should the responder choose?

1. Allow
   2. Block
   3. Detect Only
   4. No action

Correct Answer: 2. Block

Explanation:

Block is appropriate when a file hash has been confirmed as malicious and the organization wants to prevent the associated file from executing. Detect Only maintains visibility without providing the same prevention behavior, while Allow is intended for trusted files. No action does not satisfy the requirement to stop execution. Responders should validate the hash carefully before applying a block to avoid disrupting legitimate software. The chosen hash action should align with both the confidence of the investigation and the desired security outcome.

Question 387.

An investigation starts with a user account suspected of being involved in malicious activity. Which capability should be used first?

1. User Search
   2. Hash Search
   3. IP Search
   4. Process Tree

Correct Answer: 1. User Search

Explanation:

User Search is the appropriate starting point when an investigation centers on a specific account. It can help responders identify activity and systems associated with that identity and provide context for further pivots into detections, processes, hosts, or network indicators. Hash Search focuses on file artifacts, IP Search focuses on network addresses, and Process Tree focuses on execution relationships. When the known starting indicator is a username, User Search provides the most direct identity-focused investigative path.

Question 388.

A suspicious external IP address is found in endpoint telemetry. Which capability should the analyst use to investigate related communications?

1. Hash Search
   2. User Search
   3. IP Search
   4. Process Timeline

Correct Answer: 3. IP Search

Explanation:

IP Search is designed for investigations involving network addresses. It can help identify endpoint activity associated with a suspicious IP and determine whether multiple systems communicated with it. This is useful when investigating potential command-and-control infrastructure or suspicious remote services. Hash Search focuses on files, User Search focuses on identities, and Process Timeline focuses on a particular process. IP Search therefore provides the most relevant network-focused investigative context.

Question 389.

An analyst wants to focus a large detection queue on unresolved high-severity items. Which functionality should be used?

1. Detection filters
   2. RTR custom scripts
   3. Sensor exclusions
   4. Hash Allow

Correct Answer: 1. Detection filters

Explanation:

Detection filters allow responders to narrow large detection queues using criteria such as severity, status, host, or other available properties. Filtering for unresolved high-severity detections helps prioritize the most urgent activity without changing endpoint security controls. RTR scripts execute response actions, while exclusions and hash actions modify security behavior or visibility. Those capabilities are not intended simply to organize alerts. Detection filtering is therefore the correct approach for focusing on a high-priority subset during triage.

Question 390.

An analyst wants a chronological view focused only on one suspicious process. Which capability should be selected?

1. Host Timeline
   2. Process Timeline
   3. User Search
   4. Bulk Domain Search

Correct Answer: 2. Process Timeline

Explanation:

Process Timeline provides a focused chronological view centered on a specific process and its associated activity. It is useful when the analyst has already identified a suspicious executable and wants to investigate its behavior without reviewing unrelated host events. Host Timeline provides broader endpoint-wide context, while User Search and Bulk Domain Search focus on different indicator types. Process Timeline therefore offers the most targeted view for understanding activity directly associated with one suspicious process.

Question 391.

A security manager needs to verify which responder executed commands during an RTR session. Which records should be reviewed?

1. RTR audit logs
   2. Internal prevalence
   3. Process Tree
   4. Detection severity

Correct Answer: 1. RTR audit logs

Explanation:

RTR audit logs provide records of actions performed during Real Time Response sessions. They can help identify which authorized responder executed specific commands and support accountability, incident documentation, troubleshooting, and compliance. Internal prevalence measures how common an artifact is, Process Tree shows execution relationships, and detection severity helps prioritize alerts. None of those sources provides the same administrative audit trail. RTR audit logs are therefore the appropriate source for verifying responder activity.

Question 392.

A threat intelligence feed contains numerous suspicious domains. Which capability is most efficient for investigating them together?

1. Bulk Domain Search
   2. Host Timeline
   3. User Search
   4. Process Tree

Correct Answer: 1. Bulk Domain Search

Explanation:

Bulk Domain Search is designed for investigations involving multiple domain indicators. It allows responders to evaluate many suspicious domains more efficiently than searching each one separately. This is especially useful when threat intelligence provides domain lists associated with phishing, malware delivery, or command-and-control infrastructure. Host Timeline and Process Tree focus on endpoint behavior, while User Search focuses on identity activity. Bulk Domain Search is therefore the most appropriate capability for handling a large set of domain indicators.

Question 393.

A suspicious process launches scripts, command-line utilities, and additional executables. Which relationship should be examined to understand downstream execution?

1. Parent process
   2. Child processes
   3. Host group
   4. Sensor policy

Correct Answer: 2. Child processes

Explanation:

Child processes show which processes were launched by another process. Reviewing them helps analysts understand what occurred after the suspicious process started and may reveal command shells, scripts, reconnaissance tools, credential-access utilities, or additional payloads. The parent process explains what launched the original process, while host groups and sensor policies provide administrative context. Child-process analysis is therefore essential for understanding downstream execution and reconstructing the progression of suspicious activity.

Question 394.

A responder verifies that an executable is trusted enterprise software and should be permitted to run. Which hash-management action is appropriate?

1. Block
   2. Detect Only
   3. Allow
   4. Block and Hide Detection

Correct Answer: 3. Allow

Explanation:

Allow is appropriate when a file has been verified as trusted and should execute normally according to organizational policy. The responder should carefully validate the file and hash before applying this action because mistakenly allowing malicious content could weaken security. Block prevents execution, while Detect Only provides monitoring without the same prevention behavior. Block and Hide Detection produces a different prevention and visibility outcome. For confirmed legitimate software, Allow is the appropriate hash-management action.

Question 395.

An analyst wants to investigate detailed enterprise telemetry related to an existing detection. Which capability should be used?

1. Event Advanced Search
   2. Host group configuration
   3. Sensor update policy
   4. User role management

Correct Answer: 1. Event Advanced Search

Explanation:

Event Advanced Search enables responders to investigate detailed telemetry beyond what is initially displayed in a detection. Analysts can search for related events, refine results, and uncover additional evidence that may help determine the scope and sequence of suspicious activity. Host groups, sensor policies, and user roles are administrative functions rather than investigative search tools. When deeper event-level analysis is required, Event Advanced Search provides the appropriate functionality for expanding an investigation.

Question 396.

A legitimate application repeatedly generates unwanted detections. What is the safest approach before creating an exclusion?

1. Exclude the entire endpoint
   2. Disable prevention globally
   3. Verify the behavior and use the narrowest effective exclusion
   4. Ignore all future alerts from the application

Correct Answer: 3. Verify the behavior and use the narrowest effective exclusion

Explanation:

Before creating an exclusion, the responder should confirm that the activity is genuinely legitimate and understand how the exclusion type will affect detection, prevention, or visibility. The scope should be kept as narrow as possible to minimize security blind spots. Excluding an entire endpoint or disabling prevention globally would significantly weaken security. Ignoring future alerts could also hide unrelated malicious behavior. A carefully validated and narrowly scoped exclusion provides the best balance between reducing false positives and maintaining protection.

Question 397.

Within MITRE ATT&CK, which concept represents the method an adversary uses to achieve an objective?

1. Tactic
   2. Technique
   3. Detection status
   4. Host policy

Correct Answer: 2. Technique

Explanation:

A technique in MITRE ATT&CK represents a method or behavior adversaries use to achieve a broader objective. Tactics represent high-level goals such as Execution, Persistence, Credential Access, or Discovery. Techniques explain how attackers may accomplish those goals. Understanding the relationship between tactics and techniques helps responders interpret ATT&CK mappings and connect observed behavior to a larger attack sequence. Detection status and host policies are separate operational concepts and do not represent adversary methods.

Question 398.

A response team wants to standardize a frequently repeated sequence of approved RTR commands. What should be created?

1. An RTR custom script
   2. A sensor visibility exclusion
   3. A detection filter
   4. A host group

Correct Answer: 1. An RTR custom script

Explanation:

An RTR custom script allows a repeated sequence of approved commands to be packaged into a reusable response workflow. This improves consistency, reduces manual command-entry errors, and can make recurring remediation procedures more efficient. Scripts should be tested carefully and restricted to authorized responders because they may perform significant endpoint actions. Sensor exclusions affect visibility, detection filters organize alerts, and host groups organize endpoints. An RTR custom script is therefore the most appropriate solution for standardizing repeated response actions.

Question 399.

An analyst suspects suspicious activity observed on one endpoint may also exist elsewhere. Which approach is best for determining scope?

1. Review only the original detection
   2. Correlate hosts, users, processes, hashes, domains, and IP addresses
   3. Close the detection immediately
   4. Disable telemetry on unaffected systems

Correct Answer: 2. Correlate hosts, users, processes, hashes, domains, and IP addresses

Explanation:

Determining incident scope requires correlating multiple forms of evidence across the environment. Analysts should examine related hosts, users, processes, file hashes, domains, IP addresses, timelines, and event data. This can reveal additional affected systems or accounts and help determine whether suspicious activity extends beyond the original endpoint. Reviewing only one detection may miss connected compromise, while disabling telemetry reduces visibility. Correlating several evidence types provides a stronger basis for understanding the full scope of an incident.

Question 400.

A suspicious executable launches scripts, network tools, and additional processes. What should the analyst review next to understand subsequent activity?

1. Subscription information
   2. Console appearance settings
   3. Host naming conventions
   4. Child processes and related events

Correct Answer: 4. Child processes and related events

Explanation:

Child processes and related events reveal what occurred after the suspicious executable began running. Reviewing them may expose reconnaissance commands, credential-access activity, persistence attempts, additional payloads, or other malicious behavior. This information helps the analyst reconstruct the attack sequence and determine whether further investigation or remediation is required. Subscription information, console appearance settings, and host naming conventions do not explain endpoint execution behavior. Examining downstream process activity and related events is therefore the most appropriate next investigative step.