Free CCFR-201b sample questions
Real questions from the Crowdstrike Certified Falcon Responder practice bank, with the correct answer and an explanation for each one. No junk, no filler.
Try them in the simulator Same questions, with study, timed and flashcard modes.
Showing 10 of 20 free sample questions.
A responder's Advanced Event Search for `ProcessRollup2` events returns results from Windows, macOS and Linux hosts. Which filter keeps only the events from Windows hosts?
A responder is reviewing a detection and sees the MITRE ATT&CK Tactic 'TA0003 - Persistence' followed by the Technique 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'. What does this information primarily indicate about the adversary's actions?
When using the Bulk Domain Search feature, a responder can upload a list of up to 5,000 domains for analysis. True or False: The results of this search will show which hosts in your environment have communicated with those domains within the last 30 days.
A responder is analyzing a detection on a Linux server. They need to collect a list of all active network connections, the process associated with each connection, and write the output to a file on the host for later retrieval. Which of the following RTR commands would accomplish this?
Which of the following pieces of information are available for a given host when viewed from the Host Search results? (Select THREE)
A security analyst is investigating a complex detection involving multiple processes. After reviewing the Process Tree, they want to understand the exact sequence of all activities performed by a single suspicious process, including file modifications, registry changes, and network connections. Which feature should the analyst pivot to from the detection details?
A detection shows a process encrypting thousands of user files, deleting the host's volume shadow copies, and leaving a ransom note in each folder. Which MITRE ATT&CK tactic best describes the adversary's goal?
**Case Study** A healthcare organization's SOC team receives a high-severity alert from the CrowdStrike Falcon console on a critical patient records server. The detection is for a PowerShell script that established a network connection to an unknown IP address, downloaded a file named `update.dll`, and then executed it using `rundll32.exe`. The Process Tree confirms this sequence of events, originating from a non-interactive service account. Initial triage reveals that the IP address has no reputation in VirusTotal, and a Hash Search shows `update.dll` only on this host, with no external prevalence. The service account is a legacy account used by an old data transfer application. The responder immediately contains the host to prevent further damage. The primary objectives now are to understand the full scope of the compromise, identify the initial access vector, and ensure no other systems are affected. Which combination of actions represents the most logical and comprehensive next steps for the investigation?
A responder is creating a Falcon Fusion workflow that uses an RTR custom script to collect forensic artifacts from Windows hosts with new detections. The PowerShell script `Triage-Collection` is already saved in the custom script library. How should the script be added to the workflow?
10 more free samples are waiting
Create a free account to unlock the whole CCFR-201b sample bank, or get full access to all 217 practice questions in the simulator.