CrowdStrike Certified Falcon Responder (CCFR-201) Free Practice Test

Question 1

What happens when a hash is set to Always Block through IOC Management?

A. The hash is submitted for approval to be blocked from execution once confirmed by Falcon specialists

B. Execution is prevented and detection alerts are suppressed

C. Execution is prevented on selected host groups

D. Execution is prevented on all hosts by default

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 2

The function of Machine Learning Exclusions is to___________.

A. stop all detections for a specific pattern ID

B. stop all sensor data collection for the matching path(s)

C. stop all ML-based detections and preventions for the matching path(s) and/or stop files from being uploaded to the CrowdStrike Cloud

D. Stop all Machine Learning Preventions but a detection will still be generated and files will still be uploaded to the CrowdStrike Cloud

Correct Answer: C

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 3

Sensor Visibility Exclusion patterns are written in which syntax?

A. RegEx

B. Kleene Star Syntax

C. Glob Syntax

D. SPL(Splunk)

Correct Answer: C

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 4

How long does detection data remain in the CrowdStrike Cloud before purging begins?

A. 30 Days

B. 90 Days

C. 14 Days

D. 45 Days

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 5

The Bulk Domain Search tool contains Domain information along with which of the following?

A. Port Information

B. Threat Actor Information

C. Process Information

D. IP Lookup Information

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 6

Where can you find hosts that are in Reduced Functionality Mode?

A. Host Search

B. Executive Summary dashboard

C. Installation Tokens

D. Event Search

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 7

What action is used when you want to save a prevention hash for later use?

A. No Action

B. Never Block

C. Always Block

D. Always Allow

Correct Answer: C

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Welcome to TestSimulate

CrowdStrike Certified Falcon Responder (CCFR-201) Free Practice Test