CCFR-201b Practice Questions

A.  

Do nothing, as this file is common and well known

B.  

From detection, click the VT Hash button to pivot to VirusTotal to investigate further

C.  

From detection, use API manager to create a custom blocklist

D.  

From detection, submit to FalconX for deep dive analysis

A.  

Create a Custom IOC with an action of allow for the hash

B.  

Create a Machine Learning Exclusion with an action of allow for the hash

C.  

Create a Custom IOA with an action of allow for the hash

D.  

Create an IOA Exclusion with an action of allow for the hash

A.  

CSWINDIAG

B.  

dumpmem

C.  

xmemdump

D.  

memdump

A.  

10%

B.  

20%

C.  

50%

D.  

100%

A.  

reg.exe

B.  

taskmgr.exe

C.  

lsass.exe

D.  

svchost.exe

A.  

Process Creation

B.  

File Creation

C.  

Domain Name

D.  

Scheduled Task

A.  

30 days

B.  

60 days

C.  

90 days

D.  

180 days

A.  

Set the -timeout argument to off

B.  

Set the -timeout argument to a longer period

C.  

Rerun the script

D.  

Change the timeout policy in the console settings

A.  

PowerShell spawned Notepad.exe, which injected a thread back to Excel.exe

B.  

The thread injection was considered a Medium severity injection

C.  

PowerShell spawned Notepad.exe, which injected a thread back to PowerShell

D.  

Notepad.exe injected itself into Excel.exe

A.  

It excludes host information from Detections and Incidents generated within that file path location

B.  

It prevents file uploads to the CrowdStrike cloud from that file path

C.  

It excludes sensor monitoring and event collection for the trusted file path

D.  

It disables detection generation from that path, however the sensor can still perform prevention actions