CrowdStrike CCFR-201b 問題練習

Question No : 1
What role does collaboration play in event investigation?

• A.It is unnecessary and slows down the process
• B.It allows for sharing of tasks and expertise
• C.It complicates decision-making
• D.It focuses only on legal aspects

答えを確認する

正解:

Question No : 2
Which use cases are supported by applying ATT&CK techniques within Falcon workflows? (Choose two)

• A.Tuning machine learning exclusion rules
• B.Building behavioral rules for custom detections
• C.Understanding lateral movement indicators
• D.Automatically launching sandbox detonations

答えを確認する

正解:

Question No : 3
What is the benefit of using the "Advanced Search" feature in the Event Search module?

• A.It allows for free-text searches only
• B.It streamlines queries using pre-defined templates
• C.It enables more complex filtering and querying
• D.It restricts results to specific time frames only

答えを確認する

正解:

Question No : 4
What two types of contextual event data can be viewed in the Full Detection View? (Choose two)

• A.Falcon sensor version
• B.File path
• C.Command-line arguments
• D.Machine learning confidence score

答えを確認する

正解:

Question No : 5
What is the primary purpose of the MITRE ATT&CK® Framework?

• A.To provide a set of guidelines for cybersecurity policies
• B.To serve as a comprehensive knowledge base of adversary tactics and techniques
• C.To endorse specific security products and vendors
• D.To offer a framework for business continuity planning

答えを確認する

正解:

Question No : 6
Which search type should be used to investigate whether a suspicious executable has affected multiple hosts?

• A.Host Search
• B.Hash Search
• C.User Search
• D.Bulk Domain Search

答えを確認する

正解:

Question No : 7
Which Falcon feature allows analysts to perform advanced searches across endpoint data?

• A.Falcon Discover
• B.Falcon Overwatch
• C.Falcon Intelligence
• D.Event Search

答えを確認する

正解:

Question No : 8
Which of the following components is not part of the MITRE ATT&CK® Framework?

• A.Techniques
• B.Procedures
• C.Threat actors
• D.Policies

答えを確認する

正解:

Question No : 9
What is the primary benefit of using Falcon Real Time Response (RTR) during an incident response?

• A.It provides historical data for analysis.
• B.It allows for immediate remediation on endpoints.
• C.It automates responses to all alerts.
• D.It eliminates the need for human analysis.

答えを確認する

正解:

Question No : 10
Which statement is true about running event searches in Falcon?

• A.Searches can only be run for the last 7 days
• B.Searches are only permitted by Super Admins
• C.Saved queries can be reused across investigations
• D.Event searches include identity mapping features

答えを確認する

正解:

Question No : 11
The __________ feature in Falcon enables analysts to trace a user’s activity across multiple hosts and correlate it with detections.

• A.Host Search
• B.User Search
• C.Detection Summary
• D.Event Explorer

答えを確認する

正解:

Question No : 12
Which scenario justifies using Host Timeline over Process Timeline?

• A.Investigating a single parent process only
• B.Correlating telemetry from one process
• C.Reviewing endpoint-wide events across all users
• D.Capturing web traffic behavior

答えを確認する

正解:

Question No : 13
A(n) ___________ is a unique artifact like a hash or domain that can be used to identify malicious activity in Falcon.

• A.IOC
• B.CSV
• C.TTP
• D.OSINT

答えを確認する

正解:

Question No : 14
Which search capability in Falcon allows investigators to identify anomalies across multiple endpoints by applying filters and grouping criteria?

• A.Basic Search
• B.Network Search
• C.Filtered Search
• D.Correlation Search

答えを確認する

正解:

Question No : 15
In detection analysis, what does a false positive indicate?

• A.A real security threat has been identified
• B.No threat exists, but an alert was triggered
• C.The system is functioning as expected
• D.An actual breach occurred

答えを確認する

正解: