CCFR-201b無料問題集「CrowdStrike Certified Falcon Responder」

質問 1

A SOC Manager is reviewing the monthly efficiency of the incident response team. They are specifically analyzing how many alerts were handled by each individual analyst and the ratio of legitimate threats to noise to optimize staffing levels. While navigating the Detection Resolutions Dashboard, which of the following metrics would they NOT find, as it is primarily located within the Activity or Executive summary dashboards?

（A）Total count of False Positives

（B）Detection resolution status breakdown

（C）Total Detections by Host

（D）Detections by user (Analyst performance)

正解：C 解答を投票する

質問 2

By default, when a file is quarantined by the Falcon sensor to prevent execution, how many days does that file remain on the host ' s local disk?

（A）7 days

（B）90 days

（C）30 days

（D）14 days

正解：C 解答を投票する

質問 3

You are pre-staging a Custom IOC for later use and want to save a file hash for later use after approval.
Which action should you use?

（A）Monitor

（B）Always Block

（C）No Action

（D）Save Hash

正解：C 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 4

What information is contained within a Process Timeline?

（A）All cloudable process-related events within a given timeframe

（B）All cloudable events for a specific host

（C）Only detection process-related events within a given timeframe

（D）A view of activities on Mac or Linux hosts

正解：A 解答を投票する

質問 5

When viewing the summary list on the ' Endpoint Detections ' page, an analyst sees a column for the timestamp. What does the timestamp in this specific summary view represent?

（A）The timestamp of the last activity recorded for that specific detection.

（B）The exact time the Falcon sensor was first installed on the host.

（C）The time the detection was first assigned to a human analyst.

（D）The file creation time for the primary process involved in the alert.

正解：A 解答を投票する

質問 6

Within the context of CrowdStrike's behavioral detection engine, what does the acronym ' IOA ' stand for?

（A）Integrated Operation Alert

（B）Indicator of Attack

（C）Internal Objective Analysis

（D）Indicator of Activity

正解：B 解答を投票する

質問 7

If a local administrator needs to inspect the quarantine directory directly on a machine, where are quarantine files located on a Windows Endpoint?

（A）C:\Temp\CrowdStrike\Quarantine

（B）C:\Users\Public\CrowdStrike\Quarantine

（C）C:\Windows\System32\Drivers\CrowdStrike\Quarantine

（D）C:\Program Files\CrowdStrike\Quarantine

正解：C 解答を投票する

質問 8

During the incident response process, a responder must update the status of a detection. Which of the following options is NOT a valid detection status recognized by the Falcon console?

（A）Complete

（B）True Positive

（C）New

（D）In Progress

正解：A 解答を投票する

質問 9

The User Search results are organized into several categories. Which of the following is NOT a sub-heading in the User Search?

（A）Admin tool usage

（B）Network Connections

（C）User Logons

（D）Unique Executables Written

正解：D 解答を投票する

質問 10

A responder wants to verify why a certain quarantined file was not uploaded to the cloud. Which specific policy dictates whether quarantined files are permitted to be uploaded?

（A）Response Policy

（B）Quarantine Management Policy

（C）Sensor Update Policy

（D）Prevention Policy

正解：D 解答を投票する

CCFR-201b 無料問題集「CrowdStrike Certified Falcon Responder」

弊社を連絡する

関連リンク

トップ試験