Free CCFR-201 sample questions

Correct answer: Pivot to the Host Timeline and look for events that occurred immediately prior to the network connection, such as Service Creation or Registry modifications.

When `svchost.exe` appears without a parent, it is often because it was started as a Windows Service. The Process Tree focuses on direct parent-child relationships and may not show the service creation event. Pivoting to the Host Timeline provides a chronological view of all system events, allowing the responder to identify the service control manager (`services.exe`) event that created the malicious service, or associated registry keys that define it.

Correct answer: 1. `runscript -CloudFile="Get-FileHandle" -CommandLine="C:\Users\Public\artifact.exe"` 2. `kill ` 3. `get C:\Users\Public\artifact.exe`

The most reliable method is to use a custom PowerShell script, such as one that leverages the `handle.exe` utility or similar functionality, to identify which process has a lock on the file. The `runscript` command is used to execute such scripts. Once the Process ID (PID) of the locking process is identified, the `kill` command can be used to terminate it, releasing the lock. Finally, the `get` command can be successfully executed to retrieve the file.

Correct answer: Create a specific IOA Exclusion for the credential dumping IOA, scoped only to the application's executable path and command line.

An IOA (Indicator of Attack) Exclusion is the most precise tool for this scenario. It allows you to suppress a specific behavioral detection (like credential dumping) but only when it originates from a specific process image name, path, and/or command line. This ensures that if any other process on the system attempts the same malicious behavior, it will still be detected, maintaining a strong security posture. Sensor Visibility Exclusions are too broad, and hash-based allowances don't address behavioral detections.

Correct answer: event_simpleName=FileWritten TargetFileName=psexec.exe FilePath=*\\ADMIN\$*

This query correctly identifies the specific event type for a file being written (`event_simpleName=FileWritten`), filters for the exact filename of interest (`TargetFileName=psexec.exe`), and crucially, uses wildcards to specify that the write path must contain the string `\\ADMIN\$`. This is the most precise way to find PsExec being staged on a remote administrative share.

Correct answer: The adversary has modified the system to ensure their code executes automatically upon system boot or user logon.

The 'Persistence' tactic (TA0003) describes actions adversaries take to maintain their foothold across restarts, changed credentials, and other interruptions. The specific technique 'T1547.001' details one method of achieving this: placing a program's path in a specific Registry Run Key or a user's Startup Folder, which causes the operating system to automatically execute it when the system starts or a user logs in.

Correct answer: True

The Bulk Domain Search tool is designed to take a large list of domains and query Falcon's historical event data to identify any endpoints that have made DNS requests for or network connections to those domains. The results provide a list of matching hosts, allowing for rapid scoping of potential compromises.

Correct answer: run `netstat -anp > /tmp/connections.txt`

The `run` command in RTR executes shell commands on the remote host. On Linux, `netstat -anp` lists all (-a) numeric (-n) network connections and the process (-p) associated with them. The `>` is the standard shell operator to redirect the output of the command to a file, in this case, `/tmp/connections.txt`. The `>>` operator would append, which is not ideal for creating a fresh report.

Correct answers: Sensor Version; Last Seen Timestamp; Currently applied Prevention Policy

Correct answer: Process Timeline

The Process Timeline is specifically designed to provide a chronological, filtered view of all events associated with a single process instance (ContextProcessId). This allows the analyst to isolate the actions of one process and see the exact sequence of its activities, which is crucial for understanding its behavior without the noise of other system events. The Host Timeline shows all events on the host, which would be too broad for this specific task.

Correct answer: The file is a legitimate tool being used for malicious purposes (LOLBin), and the low prevalence indicates it's not a widespread, known-bad file.

`procdump.exe` is a legitimate utility from Microsoft's Sysinternals suite, used for process diagnostics. However, attackers frequently abuse it to dump credentials from the LSASS process memory. A low external prevalence score (like '1') for the official `procdump.exe` hash is expected because it's not malware itself and is typically only found on systems where administrators have placed it. The detection is triggered by the *behavior* (reading LSASS memory), not the file's reputation. This is a classic example of a Living-Off-the-Land Binary (LOLBin) attack.