Free CrowdStrike CCFR-201b Exam Dumps Questions & Answers

A responder decides to set a specific Custom IOA to the ' Monitor ' action. Which of the following sentences best describes the technical result of this choice?

• A.  The sensor will automatically isolate the host from the network.
• B.  The sensor will block the activity and alert the user with a pop-up.
• C.  The sensor will create detections with ' Informational ' severity but will not block the activity.
• D.  The sensor will log the activity in the audit logs but will not generate a detection.

An analyst is triaging a detection that has been categorized under the 'Follow Through' Objective Layer.
Based on the Falcon technical documentation, which of the following adversary tactics is most likely to be observed within this specific layer?

• A.  Collection of sensitive data for exfiltration
• B.  Initial Access via a drive-by download
• C.  Credential Access through memory scraping
• D.  Discovery of local network shares and services

In the ' Investigate > Hunt > Linux Sensors ' dashboard, responders can view various Linux-specific activities.
Which of the following sub-titling is NOT displayed in this dashboard?

• A.  User Logins
• B.  Sudo Executions
• C.  Kernel Module Loads
• D.  Cron Usage

During a targeted investigation into a potentially compromised internal administrative account, a responder utilizes the User Search functionality within the Investigate menu. The goal is to identify if the account was leveraged to drop or launch unauthorized binaries across multiple systems in the environment. Which specific data category is natively visible in the User Search results to facilitate this check?

• A.  Network File Transfer ports
• B.  Unique Executables Written and Process Executions
• C.  Registry Key Operations
• D.  BIOS and Hardware modification logs

Responders must understand the limitations and capabilities of custom rules. Which of the following statements about custom IOAs is FALSE?

• A.  A Custom IOA rule group can only be applied to one single prevention policy.
• B.  They can generate ' Informational ' detections if set to the ' Monitor ' action.
• C.  They allow for pattern matching using wildcards or specific strings.
• D.  They can be used to monitor or block specific command-line strings.