{"id":17555,"date":"2026-09-21T10:11:33","date_gmt":"2026-09-21T10:11:33","guid":{"rendered":"https:\/\/www.examlabs.com\/certification\/?p=17555"},"modified":"2026-09-21T10:11:33","modified_gmt":"2026-09-21T10:11:33","slug":"crowdstrike-ccfr-201-practice-test-questions-and-exam-dumps-part19-q361-380","status":"publish","type":"post","link":"https:\/\/www.examlabs.com\/certification\/crowdstrike-ccfr-201-practice-test-questions-and-exam-dumps-part19-q361-380\/","title":{"rendered":"CrowdStrike CCFR-201 Practice Test Questions and Exam Dumps Part19 Q361-380"},"content":{"rendered":"

View Full <\/b>CrowdStrike CCFR-201 Exam Dumps<\/b><\/a> and Practice Test Dumps<\/b><\/h2>\n

Question 361.<\/b><\/p>\n

An analyst observes that a suspicious scripting process was launched by an unexpected application. Which relationship should be reviewed first?<\/b><\/p>\n

    \n
  1. <\/b> Parent process<\/span>
    \n<\/span>2.<\/b> Child process<\/span>
    \n<\/span>3.<\/b> Host group<\/span>
    \n<\/span>4.<\/b> Sensor policy<\/span><\/li>\n<\/ol>\n

    Correct Answer: 1. Parent process<\/b><\/p>\n

    Explanation:<\/b><\/p>\n

    The parent process identifies the process that directly launched another process. Reviewing it helps the analyst understand how suspicious execution began and can reveal unusual relationships, such as an office application or browser launching a scripting engine. Child processes show what was launched afterward, while host groups and sensor policies provide administrative context rather than execution details. Examining the parent process is therefore the most direct way to determine the origin of suspicious activity and begin reconstructing the execution chain.<\/span><\/p>\n

    Question 362.<\/b><\/p>\n

    A responder has identified a suspicious file hash and wants to locate other endpoints where the file has appeared. Which capability should be used?<\/b><\/p>\n

      \n
    1. <\/b> User Search<\/span>
      \n<\/span>2.<\/b> Hash Search<\/span>
      \n<\/span>3.<\/b> IP Search<\/span>
      \n<\/span>4.<\/b> Host Timeline<\/span><\/li>\n<\/ol>\n

      Correct Answer: 2. Hash Search<\/b><\/p>\n

      Explanation:<\/b><\/p>\n

      Hash Search is designed for investigations involving a known file hash. It can help responders identify additional endpoints where the same file has appeared and determine whether suspicious activity is isolated or widespread. User Search focuses on identities, IP Search focuses on network addresses, and Host Timeline provides chronological activity for one endpoint. When the known indicator is a file hash, Hash Search offers the most direct method for locating related systems and expanding the scope of the investigation.<\/span><\/p>\n

      Question 363.<\/b><\/p>\n

      An analyst wants to review activity across an endpoint in chronological order around the time of a detection. Which capability should be selected?<\/b><\/p>\n

        \n
      1. <\/b> Process Tree<\/span>
        \n<\/span>2.<\/b> User Search<\/span>
        \n<\/span>3.<\/b> Host Timeline<\/span>
        \n<\/span>4.<\/b> Hash management<\/span><\/li>\n<\/ol>\n

        Correct Answer: 3. Host Timeline<\/b><\/p>\n

        Explanation:<\/b><\/p>\n

        Host Timeline provides a chronological view of activity across an endpoint. It can help analysts reconstruct events that occurred before, during, and after suspicious behavior and reveal related activity that may not have been obvious from the original detection. Process Tree focuses on hierarchical process relationships, while User Search and hash management serve different purposes. When broad endpoint-level chronological context is required, Host Timeline is the most appropriate investigative capability.<\/span><\/p>\n

        Question 364.<\/b><\/p>\n

        An authorized responder must remotely investigate a compromised endpoint and execute approved commands. Which capability should be used?<\/b><\/p>\n

          \n
        1. <\/b> Detection filtering<\/span>
          \n<\/span>2.<\/b> Bulk Domain Search<\/span>
          \n<\/span>3.<\/b> User Search<\/span>
          \n<\/span>4.<\/b> Real Time Response<\/span><\/li>\n<\/ol>\n

          Correct Answer: 4. Real Time Response<\/b><\/p>\n

          Explanation:<\/b><\/p>\n

          Real Time Response enables authorized responders to interact directly with supported endpoints. Through RTR, they can execute approved commands, inspect files, gather evidence, and perform remediation remotely. Detection filtering organizes alerts, while Bulk Domain Search and User Search provide investigative context without direct endpoint control. Because RTR can make significant changes to systems, access should be restricted appropriately and actions should be auditable. RTR is therefore the correct capability for active remote investigation and remediation.<\/span><\/p>\n

          Question 365.<\/b><\/p>\n

          A suspicious executable appears on only one endpoint in a large enterprise. Which investigative concept best describes this observation?<\/b><\/p>\n

            \n
          1. <\/b> Internal prevalence<\/span>
            \n<\/span>2.<\/b> Detection severity<\/span>
            \n<\/span>3.<\/b> Host containment<\/span>
            \n<\/span>4.<\/b> User privilege<\/span><\/li>\n<\/ol>\n

            Correct Answer: 1. Internal prevalence<\/b><\/p>\n

            Explanation:<\/b><\/p>\n

            Internal prevalence describes how common or rare an artifact is within the organization’s own environment. A file found on only one endpoint has low internal prevalence and may deserve closer investigation, especially when combined with suspicious behavior. Low prevalence alone does not prove maliciousness, so analysts should also review process activity, reputation, network connections, and related detections. Detection severity, containment status, and user privilege represent different security properties and do not measure how widely a file appears.<\/span><\/p>\n

            Question 366.<\/b><\/p>\n

            A confirmed malicious file must be prevented from executing. Which hash-management action should be selected?<\/b><\/p>\n

              \n
            1. <\/b> Allow<\/span>
              \n<\/span>2.<\/b> Block<\/span>
              \n<\/span>3.<\/b> Detect Only<\/span>
              \n<\/span>4.<\/b> No action<\/span><\/li>\n<\/ol>\n

              Correct Answer: 2. Block<\/b><\/p>\n

              Explanation:<\/b><\/p>\n

              Block is appropriate when a file hash has been confirmed as malicious and the organization wants to prevent the associated file from executing. Detect Only preserves monitoring without providing the same prevention behavior, while Allow is intended for trusted files. No action does not satisfy the prevention requirement. Responders should validate the hash carefully before applying a block to avoid disrupting legitimate software. The selected hash action should reflect the confidence of the investigation and the desired security outcome.<\/span><\/p>\n

              Question 367.<\/b><\/p>\n

              An investigation begins with a username suspected of being involved in malicious activity. Which capability should be used first?<\/b><\/p>\n

                \n
              1. <\/b> User Search<\/span>
                \n<\/span>2.<\/b> Hash Search<\/span>
                \n<\/span>3.<\/b> IP Search<\/span>
                \n<\/span>4.<\/b> Process Tree<\/span><\/li>\n<\/ol>\n

                Correct Answer: 1. User Search<\/b><\/p>\n

                Explanation:<\/b><\/p>\n

                User Search is the appropriate starting point when an investigation centers on a specific account. It can help responders identify activity and systems associated with that identity and provide context for further pivots into detections, processes, hosts, or network indicators. Hash Search focuses on file artifacts, IP Search focuses on network addresses, and Process Tree focuses on execution relationships. When a username is the known starting indicator, User Search provides the most direct identity-focused investigative approach.<\/span><\/p>\n

                Question 368.<\/b><\/p>\n

                A suspicious external IP address appears in endpoint telemetry. Which capability should the analyst use to investigate related communications?<\/b><\/p>\n

                  \n
                1. <\/b> Hash Search<\/span>
                  \n<\/span>2.<\/b> User Search<\/span>
                  \n<\/span>3.<\/b> IP Search<\/span>
                  \n<\/span>4.<\/b> Process Timeline<\/span><\/li>\n<\/ol>\n

                  Correct Answer: 3. IP Search<\/b><\/p>\n

                  Explanation:<\/b><\/p>\n

                  IP Search is intended for investigations involving network addresses. It can help identify endpoint activity associated with a suspicious IP and determine whether multiple systems communicated with it. This is useful when investigating potential command-and-control infrastructure or suspicious remote services. Hash Search focuses on files, User Search focuses on identities, and Process Timeline focuses on a particular process. IP Search therefore provides the most relevant network-focused investigative context.<\/span><\/p>\n

                  Question 369.<\/b><\/p>\n

                  An analyst needs to focus a large detection queue on unresolved high-severity items. Which functionality should be used?<\/b><\/p>\n

                    \n
                  1. <\/b> Detection filters<\/span>
                    \n<\/span>2.<\/b> RTR custom scripts<\/span>
                    \n<\/span>3.<\/b> Sensor exclusions<\/span>
                    \n<\/span>4.<\/b> Hash Allow<\/span><\/li>\n<\/ol>\n

                    Correct Answer: 1. Detection filters<\/b><\/p>\n

                    Explanation:<\/b><\/p>\n

                    Detection filters allow responders to narrow large detection queues using criteria such as severity, status, host, or other available properties. Filtering for unresolved high-severity detections helps analysts prioritize the most urgent activity without changing endpoint protection controls. RTR scripts execute response actions, while exclusions and hash actions modify security behavior or visibility. Those capabilities are not intended simply to organize alert queues. Detection filtering is therefore the correct approach for focusing on a high-priority subset.<\/span><\/p>\n

                    Question 370.<\/b><\/p>\n

                    An analyst wants to review events related only to one suspicious process. Which capability should be selected?<\/b><\/p>\n

                      \n
                    1. <\/b> Host Timeline<\/span>
                      \n<\/span>2.<\/b> Process Timeline<\/span>
                      \n<\/span>3.<\/b> User Search<\/span>
                      \n<\/span>4.<\/b> Bulk Domain Search<\/span><\/li>\n<\/ol>\n

                      Correct Answer: 2. Process Timeline<\/b><\/p>\n

                      Explanation:<\/b><\/p>\n

                      Process Timeline provides a focused chronological view centered on a specific process and its associated activity. It is useful when the analyst has already identified a suspicious executable and wants to investigate its behavior without reviewing unrelated host events. Host Timeline provides broader endpoint-wide context, while User Search and Bulk Domain Search focus on different indicator types. Process Timeline therefore offers the most targeted view for understanding activity directly associated with one suspicious process.<\/span><\/p>\n

                      Question 371.<\/b><\/p>\n

                      A security manager wants to verify which responder executed commands during an RTR session. What should be reviewed?<\/b><\/p>\n

                        \n
                      1. <\/b> RTR audit logs<\/span>
                        \n<\/span>2.<\/b> Internal prevalence<\/span>
                        \n<\/span>3.<\/b> Process Tree<\/span>
                        \n<\/span>4.<\/b> Detection severity<\/span><\/li>\n<\/ol>\n

                        Correct Answer: 1. RTR audit logs<\/b><\/p>\n

                        Explanation:<\/b><\/p>\n

                        RTR audit logs provide records of actions performed during Real Time Response sessions. They can help identify which authorized responder executed specific commands and support accountability, incident documentation, troubleshooting, and compliance. Internal prevalence measures how common an artifact is, Process Tree shows execution relationships, and detection severity helps prioritize alerts. None of those sources provides the same administrative audit trail. RTR audit logs are therefore the appropriate source for verifying responder activity.<\/span><\/p>\n

                        Question 372.<\/b><\/p>\n

                        A threat intelligence feed includes dozens of suspicious domains. Which capability is most efficient for investigating them together?<\/b><\/p>\n

                          \n
                        1. <\/b> Bulk Domain Search<\/span>
                          \n<\/span>2.<\/b> Host Timeline<\/span>
                          \n<\/span>3.<\/b> User Search<\/span>
                          \n<\/span>4.<\/b> Process Tree<\/span><\/li>\n<\/ol>\n

                          Correct Answer: 1. Bulk Domain Search<\/b><\/p>\n

                          Explanation:<\/b><\/p>\n

                          Bulk Domain Search is designed for investigations involving multiple domain indicators. It allows responders to evaluate many suspicious domains more efficiently than searching each one individually. This is especially useful when threat intelligence provides domain lists associated with phishing, malware delivery, or command-and-control infrastructure. Host Timeline and Process Tree focus on endpoint activity, while User Search focuses on identities. Bulk Domain Search is therefore the most appropriate capability for handling a large set of domain indicators.<\/span><\/p>\n

                          Question 373.<\/b><\/p>\n

                          A suspicious process launches scripts, command-line utilities, and additional executables. Which relationship should be examined to understand downstream activity?<\/b><\/p>\n

                            \n
                          1. <\/b> Parent process<\/span>
                            \n<\/span>2.<\/b> Child processes<\/span>
                            \n<\/span>3.<\/b> Host group<\/span>
                            \n<\/span>4.<\/b> Sensor policy<\/span><\/li>\n<\/ol>\n

                            Correct Answer: 2. Child processes<\/b><\/p>\n

                            Explanation:<\/b><\/p>\n

                            Child processes show which processes were launched by another process. Reviewing them helps analysts understand what happened after the suspicious process started and may reveal command shells, scripts, reconnaissance tools, credential-access utilities, or additional payloads. The parent process explains what launched the original process, while host groups and sensor policies provide administrative context. Child-process analysis is therefore essential for understanding downstream execution and reconstructing the progression of suspicious activity.<\/span><\/p>\n

                            Question 374.<\/b><\/p>\n

                            A responder verifies that an executable is trusted enterprise software and should be permitted to run. Which hash-management action is appropriate?<\/b><\/p>\n

                              \n
                            1. <\/b> Block<\/span>
                              \n<\/span>2.<\/b> Detect Only<\/span>
                              \n<\/span>3.<\/b> Allow<\/span>
                              \n<\/span>4.<\/b> Block and Hide Detection<\/span><\/li>\n<\/ol>\n

                              Correct Answer: 3. Allow<\/b><\/p>\n

                              Explanation:<\/b><\/p>\n

                              Allow is appropriate when a file has been verified as trusted and should execute normally according to organizational policy. The responder should carefully validate the file and hash before applying this action because mistakenly allowing malicious content could weaken security. Block prevents execution, while Detect Only provides monitoring without the same prevention behavior. Block and Hide Detection produces a different prevention and visibility outcome. For confirmed legitimate software, Allow is the appropriate hash-management action.<\/span><\/p>\n

                              Question 375.<\/b><\/p>\n

                              An analyst wants to investigate detailed enterprise event telemetry related to an existing detection. Which capability should be used?<\/b><\/p>\n

                                \n
                              1. <\/b> Event Advanced Search<\/span>
                                \n<\/span>2.<\/b> Host group configuration<\/span>
                                \n<\/span>3.<\/b> Sensor update policy<\/span>
                                \n<\/span>4.<\/b> User role management<\/span><\/li>\n<\/ol>\n

                                Correct Answer: 1. Event Advanced Search<\/b><\/p>\n

                                Explanation:<\/b><\/p>\n

                                Event Advanced Search enables responders to investigate detailed telemetry beyond what is initially displayed in a detection. Analysts can search for related events, refine results, and uncover additional evidence that may help determine the scope and sequence of suspicious activity. Host groups, sensor policies, and user roles are administrative capabilities rather than investigative search tools. When deeper event-level analysis is required, Event Advanced Search provides the appropriate functionality for expanding an investigation.<\/span><\/p>\n

                                Question 376.<\/b><\/p>\n

                                A legitimate application repeatedly generates unwanted detections. What is the safest approach before creating an exclusion?<\/b><\/p>\n

                                  \n
                                1. <\/b> Exclude the entire endpoint<\/span>
                                  \n<\/span>2.<\/b> Disable prevention globally<\/span>
                                  \n<\/span>3.<\/b> Verify the behavior and use the narrowest effective exclusion<\/span>
                                  \n<\/span>4.<\/b> Ignore all future alerts from the application<\/span><\/li>\n<\/ol>\n

                                  Correct Answer: 3. Verify the behavior and use the narrowest effective exclusion<\/b><\/p>\n

                                  Explanation:<\/b><\/p>\n

                                  Before creating an exclusion, the responder should confirm that the activity is genuinely legitimate and understand how the exclusion type will affect detection, prevention, or visibility. The scope should be kept as narrow as possible to minimize security blind spots. Excluding an entire endpoint or disabling prevention globally would significantly weaken security. Ignoring future alerts could also hide unrelated malicious behavior. A carefully validated and narrowly scoped exclusion provides the best balance between reducing false positives and maintaining protection.<\/span><\/p>\n

                                  Question 377.<\/b><\/p>\n

                                  Within MITRE ATT&CK, which concept represents a high-level adversary objective?<\/b><\/p>\n

                                    \n
                                  1. <\/b> Tactic<\/span>
                                    \n<\/span>2.<\/b> Technique<\/span>
                                    \n<\/span>3.<\/b> Detection status<\/span>
                                    \n<\/span>4.<\/b> Host policy<\/span><\/li>\n<\/ol>\n

                                    Correct Answer: 1. Tactic<\/b><\/p>\n

                                    Explanation:<\/b><\/p>\n

                                    A tactic in MITRE ATT&CK represents a high-level adversary objective, such as Execution, Persistence, Credential Access, Discovery, or Exfiltration. Techniques describe the specific methods attackers use to achieve those objectives. Understanding this relationship helps responders interpret ATT&CK mappings and connect observed activity to a broader attack sequence. Detection status and host policies are separate operational concepts and do not represent adversary objectives within the ATT&CK framework.<\/span><\/p>\n

                                    Question 378.<\/b><\/p>\n

                                    A response team wants to standardize a frequently repeated sequence of approved RTR commands. What should be created?<\/b><\/p>\n

                                      \n
                                    1. <\/b> An RTR custom script<\/span>
                                      \n<\/span>2.<\/b> A sensor visibility exclusion<\/span>
                                      \n<\/span>3.<\/b> A detection filter<\/span>
                                      \n<\/span>4.<\/b> A host group<\/span><\/li>\n<\/ol>\n

                                      Correct Answer: 1. An RTR custom script<\/b><\/p>\n

                                      Explanation:<\/b><\/p>\n

                                      An RTR custom script allows a repeated sequence of approved commands to be packaged into a reusable response workflow. This improves consistency, reduces manual command-entry errors, and can make recurring remediation procedures more efficient. Scripts should be tested carefully and restricted to authorized responders because they may perform significant endpoint actions. Sensor exclusions affect visibility, detection filters organize alerts, and host groups organize endpoints. An RTR custom script is therefore the most appropriate solution for standardizing repeated response actions.<\/span><\/p>\n

                                      Question 379.<\/b><\/p>\n

                                      An analyst suspects suspicious activity observed on one endpoint may also exist elsewhere in the environment. Which approach is best for determining scope?<\/b><\/p>\n

                                        \n
                                      1. <\/b> Review only the original detection<\/span>
                                        \n<\/span>2.<\/b> Correlate hosts, users, processes, hashes, domains, and IP addresses<\/span>
                                        \n<\/span>3.<\/b> Close the detection immediately<\/span>
                                        \n<\/span>4.<\/b> Disable telemetry on unaffected systems<\/span><\/li>\n<\/ol>\n

                                        Correct Answer: 2. Correlate hosts, users, processes, hashes, domains, and IP addresses<\/b><\/p>\n

                                        Explanation:<\/b><\/p>\n

                                        Determining incident scope requires correlating multiple forms of evidence across the environment. Analysts should examine related hosts, users, processes, file hashes, domains, IP addresses, timelines, and event data. This can reveal additional affected systems or accounts and help determine whether suspicious activity extends beyond the original endpoint. Reviewing only one detection may miss connected compromise, while disabling telemetry reduces visibility. Correlating several evidence types provides a stronger basis for understanding the full scope of an incident.<\/span><\/p>\n

                                        Question 380.<\/b><\/p>\n

                                        A suspicious executable launches scripts, network tools, and additional processes. What should the analyst review next to understand subsequent activity?<\/b><\/p>\n

                                          \n
                                        1. <\/b> Subscription information<\/span>
                                          \n<\/span>2.<\/b> Console appearance settings<\/span>
                                          \n<\/span>3.<\/b> Host naming conventions<\/span>
                                          \n<\/span>4.<\/b> Child processes and related events<\/span><\/li>\n<\/ol>\n

                                          Correct Answer: 4. Child processes and related events<\/b><\/p>\n

                                          Explanation:<\/b><\/p>\n

                                          Child processes and related events reveal what occurred after the suspicious executable began running. Reviewing them may expose reconnaissance commands, credential-access activity, persistence attempts, additional payloads, or other malicious behavior. This information helps the analyst reconstruct the attack sequence and determine whether further investigation or remediation is required. Subscription information, console appearance settings, and host naming conventions do not explain endpoint execution behavior. Examining downstream process activity and related events is therefore the most appropriate next investigative step.<\/span><\/p>\n

                                           <\/p>\n","protected":false},"excerpt":{"rendered":"

                                          View Full CrowdStrike CCFR-201 Exam Dumps and Practice Test Dumps Question 361. An analyst observes that a suspicious scripting process was launched by an unexpected application. Which relationship should be reviewed first? Parent process 2. Child process 3. Host group 4. Sensor policy Correct Answer: 1. Parent process Explanation: The parent process identifies the process […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1648,1647],"tags":[],"_links":{"self":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/17555"}],"collection":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/comments?post=17555"}],"version-history":[{"count":1,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/17555\/revisions"}],"predecessor-version":[{"id":17556,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/17555\/revisions\/17556"}],"wp:attachment":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/media?parent=17555"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/categories?post=17555"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/tags?post=17555"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}