CCFR-201b sample questions

Question 1

**Case Study**

A healthcare organization's SOC team receives a high-severity alert from the CrowdStrike Falcon console on a critical patient records server. The detection is for a PowerShell script that established a network connection to an unknown IP address, downloaded a file named `update.dll`, and then executed it using `rundll32.exe`. The Process Tree confirms this sequence of events, originating from a non-interactive service account.

Initial triage reveals that the IP address has no reputation in VirusTotal, and a Hash Search shows `update.dll` only on this host, with no external prevalence. The service account is a legacy account used by an old data transfer application. The responder immediately contains the host to prevent further damage. The primary objectives now are to understand the full scope of the compromise, identify the initial access vector, and ensure no other systems are affected.

Which combination of actions represents the most logical and comprehensive next steps for the investigation?

Accepted Answer

Perform a User Search on the service account to find other logins, run an Event Search for the same PowerShell activity on other hosts, and perform an IP Search for the IP.

Answer

Pivot to the Host Timeline to see what the service account did before the PowerShell execution, and connect with RTR to dump memory from the `rundll32.exe` process.

Answer

Use RTR to delete `update.dll`, remove the host from containment, and add the IP to the blocklist.

Answer

Create an IOC for the `update.dll` hash with 'Detect Only' and create an IOA exclusion for the PowerShell activity to prevent future false positives.

Question 2

A responder is creating a Falcon Fusion workflow that uses an RTR custom script to collect forensic artifacts from Windows hosts with new detections. The PowerShell script `Triage-Collection` is already saved in the custom script library. How should the script be added to the workflow?

Accepted Answer

Add a condition for the host's platform, then a Real Time Response action that runs the `Triage-Collection` script.

Answer

Re-upload the script as a put-file, because workflows cannot use custom scripts.

Answer

Enter `runscript -CloudFile="Triage-Collection"` as the workflow's trigger.

Answer

Add a Real Time Response action that uses `put` to copy `Triage-Collection` to each host.

Question 3

A file quarantined by Falcon on a Windows host is stored in a protected directory to prevent tampering. An analyst needs to retrieve this file for further analysis. They should use the `get` command in RTR to retrieve the file from which default directory?

Accepted Answer

C:\Windows\System32\drivers\CrowdStrike\Quarantine\

Answer

C:\Windows\Temp\CrowdStrike\

Answer

C:\ProgramData\CrowdStrike\Quarantine\

Answer

C:\Users\ \AppData\Local\CrowdStrike\

Question 4

A security manager asks a responder to provide an audit trail of all Real Time Response sessions initiated by the SOC team in the past week, including who initiated the session and which commands were run. Where can the responder find this information in the Falcon console?

Accepted Answer

In the Real Time Response session audit log.

Answer

On the Activity dashboard.

Answer

In the list of Falcon users and their roles.

Answer

On the Endpoint detections page.

Question 5

What is the primary difference between the information provided by a User Search and a Host Search in the Falcon console?

Accepted Answer

User Search shows one user's logon activity across all hosts, while Host Search shows the details of one endpoint.

Answer

User Search can only be performed on domain accounts, while Host Search works for all endpoints.

Answer

User Search shows policy assignments, while Host Search shows sensor versions.

Answer

User Search is limited to the last 24 hours, while Host Search retains data for 30 days.

Question 6

A responder is analyzing the following process relationship discovered in a detection's Process Tree. Based on this diagram, which process shows how the malicious document most likely reached the endpoint?
```mermaid
graph TD
A[outlook.exe] --> B[winword.exe];
B --> C[cmd.exe];
C --> D[powershell.exe];
```

Accepted Answer

`outlook.exe`

Answer

`cmd.exe`

Answer

`powershell.exe`

Answer

`winword.exe`

Question 7

A detection is generated for a process that wrote a file with a specific hash. A responder wants to quickly determine if this same file exists on any other hosts in the environment. Which Falcon search tool is the most direct and efficient way to achieve this?

Accepted Answer

Hash Search

Answer

Bulk Domain Search

Answer

Event Search

Answer

Host Search

Question 8

A Falcon detection shows an unknown process opening the memory of `lsass.exe` and writing a dump file to `C:\Windows\Temp`. Which MITRE ATT&CK tactic does this activity most directly serve?

Accepted Answer

Credential Access (TA0006)

Answer

Lateral Movement (TA0008)

Answer

Persistence (TA0003)

Answer

Privilege Escalation (TA0004)

Question 9

Which of the following are valid Hash Management Actions that can be applied to a custom IOC in the Falcon console? (Select TWO)

Accepted Answer

Detect Only

Accepted Answer

Block and Hide Detection

Answer

Analyze in Sandbox

Answer

Quarantine

Question 10

The RTR command `reg query` is used to query the Windows Registry, but it cannot be used to modify registry values. True or False?

Accepted Answer

False

Answer

True

Top vendors

Top exams

Free CCFR-201b sample questions