CCFR-201b問題集、CrowdStrike実際の試験問題

質問 1

To manage the lifecycle of security incidents and review new alerts, a responder must navigate through the Falcon sidebar to which specific location?

A. Endpoint Security > Monitor > Endpoint Detections

B. Dashboards > Global Activity > Security Alerts

C. Configuration > Security Policies > Detections

D. Investigate > Host Search > Alerts

正解: A

質問 2

To maintain a logical flow during an incident post-mortem, CrowdStrike recommends describing adversary activity using a specific three-part sentence structure. Which combination best completes this sentence: " The adversary was trying to [1], by [2] , using [3] " ?

A. < Technique > , < Tactic > , < Objective >

B. < Objective > , < Tactic > , < Technique >

C. < Objective > , < Technique > , < Tactic >

D. < Tactic > , < Objective > , < Technique >

正解: B

質問 3

Analyze the following process lineage observed during a detection triage on a Windows 10 workstation:
root > smss.exe > winlogon.exe > userinit.exe > explorer.exe > windows_media_player_y35s21-4ak.exe.
Based on the fact that the suspicious process originated from the user ' s desktop shell environment (explorer.
exe), what is the most likely entry vector for this attack?

A. User execution via a Phishing email or drive-by download

B. Credential theft through a compromised Domain Controller

C. Remote exploitation of a system service

D. Malicious persistence via a WMI event subscription

正解: A

質問 4

Which of the following is returned from the IP Search tool?

A. Unmanaged host data from system ARP tables for the given IP

B. Threat Graph Data for the given IP from Falcon sensors

C. IP Summary information from Falcon events containing the given IP

D. IP Detection Summary information for detection events containing the given IP

正解: C

質問 5

In the " Full Detection Details " , which view will provide an exportable text listing of events like DNS requests. Registry Operations, and Network Operations?

A. View as Process Activity

B. View as Process Tree

C. Thedata is unable to be exported

D. View as Process Timeline

正解: A

質問 6

Which of the following is an example of a MITRE ATT AND CK tactic?

A. Emotet

B. Defense Evasion

C. Phishing

D. Eternal Blue

正解: B

質問 7

Evaluate the following process tree observed in a detection:
root > smss.exe > winlogon.exe > userinit.exe > explorer.exe > windows_media_player_y35s21-4ak.exe Based on the parent-child relationships, which entry source is most likely?

A. A remote service exploitation targeting a system process.

B. A phishing attack where the user executed a malicious file from the desktop.

C. A supply chain attack targeting the Windows Boot manager.

D. A scheduled task running under the SYSTEM account.

正解: B

質問 8

CrowdStrike provides ' Overwatch Best Practices ' for triaging alerts. According to these guidelines, what is the next step a responder should take immediately after the ' Understand the detection ' step?

A. Resolve the detection as a True Positive.

B. Isolate the host from the network.

C. Review the process tree to understand the origin of the activity.

D. Perform an OSINT search for the suspicious hash.

正解: C

質問 9

When an analyst is trying to pinpoint the exact moment an endpoint came online after being shut down for the weekend, which timeline view is the best to use?

A. Network Timeline

B. Host Timeline

C. User Timeline

D. Process Timeline

正解: B

質問 10

What must be true about a custom script before it can be executed from within a Fusion SOAR Workflow?

A. The script must contain input and output JSON fields

B. The Share with workflows option must be enabled for the custom script

C. The Response Policy must allow for the execution of Workflows

D. The script must exist on the host locally

正解: B

解説: (PassTest メンバーにのみ表示されます)

CrowdStrike Certified Falcon Responder - CCFR-201b 模擬練習