View Full CrowdStrike CCFR-201 Exam Dumps and Practice Test Dumps

 

Question 121.

An analyst is reviewing a detection and wants to understand which process directly created the suspicious process. Which relationship should be examined?

1. Parent process
   2. Child process
   3. Sibling process
   4. Host group

Correct Answer: 1. Parent process

Explanation:

The parent process is the process that directly launched or created another process. Examining this relationship helps the analyst determine how suspicious execution began and can reveal unusual process chains. For example, an office application unexpectedly launching a command shell may indicate malicious document activity. Child processes show what the suspicious process started afterward, while sibling processes share a parent without identifying the direct origin. Host groups provide administrative organization rather than execution context. Reviewing the parent process is therefore an important step when tracing the source of suspicious endpoint behavior.

Question 122.

A responder needs to find every endpoint where a known malicious file hash has been observed. Which Falcon capability is most appropriate?

1. User Search
   2. Hash Search
   3. IP Search
   4. Process Timeline

Correct Answer: 2. Hash Search

Explanation:

Hash Search enables responders to investigate a known file hash across the environment. It can help identify additional endpoints where the same executable or file has appeared, making it useful for determining incident scope. This is particularly important when a malware sample has already been identified and the analyst wants to determine whether the compromise extends beyond the original system. User Search focuses on identities, IP Search investigates network addresses, and Process Timeline examines activity associated with a particular process. Hash Search is therefore the most direct option for investigating file distribution.

Question 123.

An analyst needs to understand activity associated with one suspicious executable without reviewing unrelated events from the endpoint. Which capability should be used?

1. Host Timeline
   2. User Search
   3. Process Timeline
   4. Bulk Domain Search

Correct Answer: 3. Process Timeline

Explanation:

Process Timeline focuses the investigation on events associated with a specific process. It is useful when the analyst has already identified a suspicious executable and wants a detailed chronological understanding of its behavior. Host Timeline provides broader endpoint activity and can contain many unrelated events. User Search focuses on account information, while Bulk Domain Search investigates multiple domains. By using Process Timeline, the responder can concentrate on process-specific evidence and better determine what the executable did before deciding whether additional investigation or remediation is required.

Question 124.

A responder must interact remotely with an affected host to gather evidence and perform approved remediation actions. Which capability should be selected?

1. Detection filtering
   2. Hash Search
   3. Host Timeline
   4. Real Time Response

Correct Answer: 4. Real Time Response

Explanation:

Real Time Response provides authorized responders with remote endpoint interaction capabilities. Through an RTR session, the responder can use supported commands to investigate files, gather information, execute approved scripts, and perform remediation without physically accessing the host. Detection filtering organizes alerts, while Hash Search and Host Timeline provide investigative information but do not offer the same interactive control. Because RTR can affect endpoint systems directly, organizations should apply appropriate permissions and maintain audit records. RTR is the appropriate capability when active remote investigation or remediation is required.

Question 125.

A suspicious file is present on hundreds of endpoints throughout the enterprise. Which factor does this observation describe?

1. Internal prevalence
   2. MITRE tactic
   3. Detection status
   4. RTR permission level

Correct Answer: 1. Internal prevalence

Explanation:

Internal prevalence represents how frequently a file or artifact appears within an organization’s own environment. A file found on hundreds of endpoints has high internal prevalence. This information can help analysts evaluate context, although high prevalence does not automatically mean that a file is trustworthy. The analyst should still consider process behavior, reputation, network activity, and other evidence. MITRE tactics describe adversary objectives, detection status tracks workflow state, and RTR permissions determine response access. Internal prevalence is therefore the factor that describes how widespread the file is internally.

Question 126.

An analyst has confirmed that a file hash is malicious and wants to prevent the corresponding file from executing. Which action is appropriate?

1. Allow
   2. Block
   3. No action
   4. Detect Only

Correct Answer: 2. Block

Explanation:

Block is appropriate when the organization has verified that a hash represents malicious or unwanted content and wants to prevent the associated file from executing. Detect Only would maintain visibility without providing the same prevention behavior, while Allow is intended for trusted files. No action would not satisfy the requirement to stop execution. Responders should carefully validate a malicious hash before blocking it because an incorrect decision can interfere with legitimate applications. Hash-management actions should always be selected according to the desired prevention and visibility outcome.

Question 127.

A responder is investigating suspicious behavior associated with a particular user account. Which search capability provides the most relevant starting point?

1. Hash Search
   2. IP Search
   3. User Search
   4. Bulk Domain Search

Correct Answer: 3. User Search

Explanation:

User Search is appropriate when an investigation begins with a username or account. It can provide account-related information and help the responder identify systems or activity associated with that identity. The analyst can then pivot into endpoint events, detections, processes, or network evidence as needed. Hash Search focuses on files, IP Search investigates network addresses, and Bulk Domain Search is designed for domain indicators. Starting with User Search keeps the investigation centered on the known identity and can help identify potentially related endpoint activity more efficiently.

Question 128.

A detection contains an unfamiliar external IP address. Which capability should the analyst use to investigate activity related to that address?

1. Process Tree
   2. Hash Search
   3. User Search
   4. IP Search

Correct Answer: 4. IP Search

Explanation:

IP Search is intended for investigations involving network addresses. When an unfamiliar external IP appears in a detection, the analyst can search the address to determine whether other endpoints or events are associated with it. This can help identify command-and-control communication, suspicious remote services, or other network-related activity. Process Tree focuses on process relationships, Hash Search investigates files, and User Search focuses on identities. Because the known indicator is an IP address, IP Search provides the most direct method for obtaining additional investigative context.

Question 129.

An analyst has thousands of detections but needs to focus specifically on unresolved detections from a particular host. Which feature should be used?

1. Detection filters
   2. RTR custom scripts
   3. Sensor visibility exclusions
   4. Hash blocking

Correct Answer: 1. Detection filters

Explanation:

Detection filters help responders narrow large detection queues using attributes such as status, host, severity, and other available criteria. Applying filters for a specific host and unresolved status allows the analyst to quickly focus on relevant alerts without changing security controls. RTR scripts perform endpoint response actions, while sensor visibility exclusions can reduce telemetry. Hash blocking changes file enforcement behavior. None of those capabilities are intended simply to organize a detection queue. Filtering is therefore the appropriate technique for efficiently prioritizing and reviewing selected detections.

Question 130.

A responder needs to see endpoint activity in chronological order across the entire host. Which investigative view should be selected?

1. Process Tree
   2. Host Timeline
   3. Hash Search
   4. User Search

Correct Answer: 2. Host Timeline

Explanation:

Host Timeline provides a chronological view of activity across an endpoint. It is useful for reconstructing what occurred before, during, and after suspicious events and can reveal related activity that may not appear in the original detection. Process Tree provides hierarchical process relationships rather than a complete host chronology. Hash Search and User Search focus on specific indicator types. When the responder needs to understand the sequence of events across the entire endpoint rather than a single process, Host Timeline provides the broader investigative context required.

Question 131.

An organization repeatedly receives detections from verified legitimate software. What should an analyst consider before creating an exclusion?

1. Disable protection on every endpoint
   2. Delete all historical detections
   3. Determine the appropriate exclusion type and narrowest scope
   4. Exclude the entire application directory automatically

Correct Answer: 3. Determine the appropriate exclusion type and narrowest scope

Explanation:

Exclusions can reduce detection, prevention, or visibility depending on their type and configuration. Before creating one, the analyst should verify that the activity is truly legitimate and determine the narrowest scope that solves the problem. Broad exclusions may unintentionally hide malicious behavior that occurs in the same location or uses similar processes. Disabling endpoint protection or automatically excluding an entire directory would create unnecessary security risk. Carefully selecting the exclusion type and scope allows the organization to reduce unwanted detections while preserving as much endpoint protection and investigative visibility as possible.

Question 132.

A security manager wants to determine who initiated a particular Real Time Response action. Which records should be reviewed?

1. Detection filters
   2. Process Tree
   3. Internal prevalence data
   4. RTR audit logs

Correct Answer: 4. RTR audit logs

Explanation:

RTR audit logs provide records associated with actions performed through Real Time Response. These records support accountability and can help determine which authorized responder initiated commands or other activities during an RTR session. They are useful for incident documentation, security oversight, compliance, and troubleshooting. Detection filters organize alerts, Process Tree shows endpoint execution relationships, and prevalence data indicates how common an artifact is. None of these sources provide the same administrative audit trail. RTR audit logs are therefore the appropriate records to review.

Question 133.

An analyst receives a threat intelligence feed containing numerous suspicious domains. Which capability is best suited for checking them efficiently?

1. Bulk Domain Search
   2. Process Timeline
   3. User Search
   4. Host Timeline

Correct Answer: 1. Bulk Domain Search

Explanation:

Bulk Domain Search is designed for investigations involving multiple domain indicators. Instead of manually investigating each suspicious domain one at a time, responders can use a bulk search to determine whether the domains have appeared in relevant environmental activity. This is especially useful when threat intelligence provides a substantial list of potential phishing, malware-delivery, or command-and-control domains. Process Timeline and Host Timeline focus on endpoint activity, while User Search focuses on identities. Bulk Domain Search is therefore the most efficient capability for processing a large domain list.

Question 134.

A suspicious script interpreter starts several additional tools. Which process relationship should the analyst examine to understand what was launched afterward?

1. Parent process
   2. Child processes
   3. Host group
   4. Sensor version

Correct Answer: 2. Child processes

Explanation:

Child processes are processes created or launched by another process. Reviewing them allows an analyst to understand what actions followed the execution of the suspicious script interpreter. The child processes might include discovery utilities, command shells, credential-access tools, or additional malicious payloads. The parent process explains what launched the script interpreter, but it does not show downstream execution. Host groups and sensor versions provide administrative or system information rather than execution relationships. Child-process analysis is therefore essential when evaluating activity that occurs after a suspicious process starts.

Question 135.

A responder confirms that an executable belongs to approved enterprise software and should be permitted to run. Which hash action should be selected?

1. Block
   2. Detect Only
   3. Allow
   4. Block and Hide Detection

Correct Answer: 3. Allow

Explanation:

Allow is appropriate when the responder has verified that a file is trusted and should be permitted according to organizational policy. The hash should be carefully validated before applying this action because an incorrect Allow decision could reduce protection against malicious content. Block prevents execution, while Detect Only continues monitoring without providing the same prevention outcome. Block and Hide Detection combines blocking behavior with different detection visibility. For a verified legitimate executable that should run normally, Allow is the hash-management action that most directly meets the stated requirement.

Question 136.

An analyst wants to search detailed enterprise event telemetry after reviewing a detection. Which capability provides this functionality?

1. Sensor policy assignment
   2. User role configuration
   3. Host group creation
   4. Event Advanced Search

Correct Answer: 4. Event Advanced Search

Explanation:

Event Advanced Search enables responders to examine detailed event telemetry beyond the information shown in an initial detection. It allows the analyst to search for related events, refine results, and pivot through additional evidence when determining the scope or sequence of suspicious activity. Sensor policies, user roles, and host groups are administrative functions and do not provide detailed telemetry searching. When an investigation needs to expand from a detection into broader enterprise event data, Event Advanced Search provides the appropriate capability for deeper analysis.

Question 137.

Within MITRE ATT&CK, what does a tactic primarily represent?

1. An adversary objective
   2. A specific file hash
   3. An endpoint policy
   4. A detection status

Correct Answer: 1. An adversary objective

Explanation:

A tactic in MITRE ATT&CK represents a high-level objective that an adversary is attempting to accomplish. Examples include Initial Access, Execution, Persistence, Credential Access, Discovery, and Exfiltration. Techniques describe the methods used to achieve those objectives. Understanding tactics helps analysts interpret why suspicious behavior may be occurring and where it fits within an attack sequence. A file hash, endpoint policy, and detection status are separate concepts and do not represent adversary objectives within the ATT&CK framework.

Question 138.

A team frequently performs the same approved series of commands during Real Time Response sessions. What should be used to standardize the procedure?

1. A detection filter
   2. An RTR custom script
   3. A sensor visibility exclusion
   4. A domain search

Correct Answer: 2. An RTR custom script

Explanation:

An RTR custom script can package an approved series of commands into a reusable workflow. This helps security teams perform recurring remediation procedures consistently and reduces the risk of manual typing errors during incident response. Custom scripts should be tested carefully and restricted to authorized users because they may perform powerful endpoint actions. Detection filters organize alerts, sensor visibility exclusions affect telemetry, and domain searches investigate network indicators. None of those options standardize a repeatable command sequence in the way an RTR custom script does.

Question 139.

An analyst suspects that activity observed on one endpoint may also exist elsewhere. Which approach is most appropriate for determining incident scope?

1. Close the original detection immediately
   2. Review only the affected host name
   3. Correlate processes, hashes, users, hosts, and network indicators
   4. Disable telemetry on unaffected systems

Correct Answer: 3. Correlate processes, hashes, users, hosts, and network indicators

Explanation:

Determining incident scope requires correlating multiple types of evidence. The analyst should examine related processes, file hashes, users, endpoints, network indicators, timelines, and relevant event data. This helps identify whether the same behavior or artifacts appear elsewhere in the environment. Looking only at the original endpoint can miss related compromise, while closing the detection prematurely could leave malicious activity unresolved. Disabling telemetry would reduce visibility. Correlating multiple evidence sources provides a stronger basis for determining whether suspicious activity is isolated or part of a broader incident.

Question 140.

A suspicious executable launches several command-line programs after execution. What should the analyst review next to understand the subsequent activity?

1. Subscription settings
   2. Host naming conventions
   3. Console appearance settings
   4. Child processes and associated events

Correct Answer: 4. Child processes and associated events

Explanation:

Child processes and associated events show what occurred after the suspicious executable began running. Reviewing them can reveal additional commands, scripts, system utilities, payloads, or other behaviors that form part of the attack chain. This information may help identify discovery, credential access, persistence, lateral movement, or other adversary activity. Subscription settings, host naming conventions, and console appearance do not explain endpoint execution behavior. Examining the downstream processes and related events is therefore the appropriate next step when reconstructing suspicious activity.