最新CrowdStrike CCFR CCFR-201b考試題庫，CrowdStrike CCFR-201b課程的擬真試題下載

問題1
Which of the following sentences best describes the technical visibility provided by the ' Host Timeline ' view?

A. A log of every time the Falcon sensor was updated or restarted.

B. A history of every hardware change or driver update on the endpoint.

C. Every host-relevant event (Process, File, Registry, Network) recorded in a given timeframe.

D. A list of every time a user has logged in or out of the machine.

正確答案: C

問題2
CrowdScore is a metric used to identify the severity of an ongoing incident. What percentage of increase in a CrowdScore is considered a strong indication of a coordinated attack?

A. 100%

B. 50%

C. 20%

D. 10%

正確答案: C

問題3
A responder is explaining the quarantine process to a system administrator. What happens technically when a file is quarantined by the Falcon sensor?

A. It is renamed to a .tmp extension and moved to the Windows Recycle Bin.

B. It is deleted from the disk and a log is sent to the cloud.

C. It is compressed, password protected, and moved to the Quarantine folder on the endpoint.

D. It is moved to the CrowdStrike Cloud and removed from the local host immediately.

正確答案: C

問題4
Aside from a Process Timeline or Event Search, how do you export process event data from a detection in .
CSV format?

A. You can ' t export detailed event data from a detection, you have to use the Process Timeline or an Event Search

B. In Full Detection Details, you choose the " View Process Activity " option and then export from that view

C. From the Detections Dashboard, you right-click the event type you wish to export and choose CSV.
JSON or XML

D. In Full Detection Details, you expand the nodes of the process tree you wish to expand and then click the " Export Process Events " button

正確答案: B

問題5
When reviewing a Host Timeline, which of the following filters is available?

A. Severity

B. User Name

C. Detection ID

D. Event Types

正確答案: D

問題6
A responder is unsure about the difference between ' Detection ' and ' Prevention ' settings. Where can they find information about Detection and Prevention Policies?

A. By clicking the ' About ' button in the user profile.

B. On the public CrowdStrike blog.

C. In the training videos on the main Dashboard.

D. In the Support page under the Docs section.

正確答案: D

問題7
Where are quarantine files located on a Mac Endpoint?

A. /Users/Shared/CS/Quarantine

B. /tmp/cs/quarantine

C. /Library/CS/Quarantine

D. /Applications/Falcon/Quarantine

正確答案: C

問題8
Which of the following sentences best describes the primary use of the ' Hash Executions ' Search (Bulk Search)?

A. It provides a detailed process tree for every execution of a single hash.

B. It allows a responder to upload a file to the cloud for detonating in a sandbox.

C. It allows for a summary view of the environment-wide presence of a given list of multiple hashes.

D. It allows an administrator to block a single hash across all machines.

正確答案: C

問題9
What information is contained within a Process Timeline?

A. All cloudable process-related events within a given timeframe

B. All cloudable events for a specific host

C. A view of activities on Mac or Linux hosts

D. Only detection process-related events within a given timeframe

正確答案: A

先試後買

購買之前，你可以先嘗試下載一個試用版本。目前我們只提供PDF版本的試用DEMO，軟件版本只提供截圖。

專業認證

品質保證

輕松通過

Try Before Buy

最新的真實試題

相關鏈接

聯繫我們