Practice Free CCFR-201b Exam Online Questions
In the context of event investigation, what role does ‘forensic analysis’ play?
- A . It focuses on improving team communication
- B . It analyzes the financial impact of an incident
- C . It helps in recovering lost data
- D . It examines evidence to determine what happened
What is the maximum timeframe you can search in CrowdStrike Falcon for historical event data?
- A . 30 days
- B . 60 days
- C . 90 days
- D . 180 days
Which of the following components is not part of the MITRE ATT&CK® Framework?
- A . Techniques
- B . Procedures
- C . Threat actors
- D . Policies
Which of the following best describes the ‘Initial Access’ tactic in the MITRE ATT&CK® Framework?
- A . The methods adversaries use to maintain access to a target
- B . The methods adversaries use to gain execution on a target
- C . The techniques used for developing and deploying malware
- D . The techniques adversaries use to enter a network or system
What is the primary purpose of the MITRE ATT&CK® Framework?
- A . To provide an open-source software tool for incident response
- B . To document techniques and tactics used by adversaries
- C . To offer a web-based interface for threat intelligence sharing
- D . To serve as a repository for malware samples
Which command in Falcon RTR can you use to gather system information from an endpoint?
- A . ps
- B . fetch
- C . get_system_info
- D . ipconfig
Which language is primarily used for writing custom queries within CrowdStrike Falcon?
- A . SQL
- B . Python
- C . Falcon Query Language (FQL)
- D . JavaScript
What is the maximum number of endpoints that can be included in a single RTR session?
- A . 5
- B . 10
- C . 50
- D . Unlimited
Which of the following describes the "Live Terminal" feature in Falcon RTR?
- A . A way to visualize network traffic live
- B . A command-line interface for interacting with an endpoint in real-time
- C . A platform for developing applications
- D . A dashboard for creating reports
Which event type is NOT searchable in CrowdStrike Falcon?
- A . Process creation
- B . Process termination
- C . File delete
- D . User login