Free CCFR-201 – CrowdStrike Certified Falcon Responder Practice Test Question

Select an option, then click Submit answer.

• ○ A behavior framework contextualizing detections
• ○ A patch management schedule
• ○ A network topology drawing tool
• ○ A list of approved security vendors

Select an option, then click Submit answer.

• ○ Deletion of volume shadow copies
• ○ Creation of scheduled task persistence
• ○ Domain generation algorithm queries
• ○ Theft of passwords, hashes, or tokens

Select an option, then click Submit answer.

• ○ Discovery tactic
• ○ Collection tactic
• ○ Impact tactic
• ○ Defense Evasion tactic

Select an option, then click Submit answer.

• ○ Lateral Movement underway
• ○ Exfiltration of data
• ○ Discovery of the environment
• ○ Initial Access entry

Select an option, then click Submit answer.

• ○ Tactic = goal; technique = method
• ○ They are interchangeable labels
• ○ Techniques outrank tactics numerically
• ○ Tactic = tool; technique = vendor

Select an option, then click Submit answer.

• ○ Installation (persistence) phase
• ○ Reconnaissance phase
• ○ Delivery phase
• ○ Weaponization phase

Select all that apply, then click Submit answer.

• ○ Immediately deleting all event logs
• ○ Compressing data for exfiltration
• ○ Creating a new scheduled task
• ○ Adding a Run registry key entry

Select all that apply, then click Submit answer.

• ○ Local privilege escalation exploits
• ○ Remote service use like PsExec
• ○ Clipboard data monitoring
• ○ Pass-the-hash authentication abuse

Answer is in the explanation below.

Select all that apply, then click Submit answer.

• ○ Blocklist the vendor's update servers
• ○ Document the determination in detection status/comments
• ○ Disable the prevention policy globally
• ○ Verify legitimacy; allowlist if appropriate

Answer is in the explanation below.

Answer is in the explanation below.