リアル試験問題CCFR-201問題集試験問題はここにある [2024年01月]
最新の2024年01月効果的なCCFR-201テスト問題を使って合格突破
質問 # 15
What information does the MITRE ATT&CKFramework provide?
- A. It provides the phases of an adversary's lifecycle, the platforms they are known to attack, and the specific methods they use
- B. It provides a step-by-step cyber incident response strategy
- C. It provides best practices for different cybersecurity domains, such as Identify and Access Management
- D. It is a system that attributes an attack techniques to a specific threat actor
正解：A
解説：
Explanation
According to the [MITRE ATT&CK website], MITRE ATT&CK is a knowledge base of adversary behaviors and techniques based on real-world observations. The knowledge base is organized into tactics and techniques, where tactics are the high-level goals of an adversary, such as initial access, persistence, lateral movement, etc., and techniques are the specific ways an adversary can achieve those goals, such as phishing, credential dumping, remote file copy, etc. The knowledge base also covers different platforms that adversaries target, such as Windows, Linux, Mac, Android, iOS, etc., and different phases of an adversary's lifecycle, such as reconnaissance, resource development, execution, command and control, etc.
質問 # 16
After running an Event Search, you can select many Event Actions depending on your results. Which of the following is NOT an option for any Event Action?
- A. Draw Process Explorer
- B. Show a Process Timeline for the responsible process
- C. Show a +/- 10-minute window of events
- D. Show Associated Event Data (from TargetProcessld_decimal or ContextProcessld_decimal)
正解：A
解説：
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Event Search tool allows you to search for events based on various criteria, such as event type, timestamp, hostname, IP address, etc1. You can also select one or more events and perform various actions, such as show a process timeline, show a host timeline, show associated event data, show a +/- 10-minute window of events, etc1. However, there is no option to draw a process explorer, which is a graphical representation of the process hierarchy and activity1.
質問 # 17
Which option indicates a hash is allowlisted?
- A. No Action
- B. Always Block
- C. Ignore
- D. Allow
正解：D
解説：
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, the allowlist feature allows you to exclude files or directories from being scanned or blocked by CrowdStrike's machine learning engine or indicators of attack (IOAs)2. This can reduce false positives and improve performance2. When you allowlist a hash, you are allowing that file to execute on any host that belongs to your organization's CID (customer ID)2. The option to indicate that a hash is allowlisted is "Allow"2.
質問 # 18
Which is TRUE regarding a file released from quarantine?
- A. No executions are allowed for 14 days after release
- B. It is deleted
- C. It will not generate future machine learning detections on the associated host
- D. It is allowed to execute on all hosts
正解：D
解説：
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, when you release a file from quarantine, you are restoring it to its original location and allowing it to execute on any host in your organization2. This action also removes the file from the quarantine list and deletes it from the CrowdStrike Cloud2.
質問 # 19
How long does detection data remain in the CrowdStrike Cloud before purging begins?
- A. 45 Days
- B. 14 Days
- C. 30 Days
- D. 90 Days
正解：D
解説：
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, detection data is stored in the CrowdStrike Cloud for 90 days before purging begins2. This means that you can access and view detections from the past 90 days using the Falcon platform or API2. If you want to retain detection data for longer than 90 days, you can use FDR to replicate it to your own storage system2.
質問 # 20
Where can you find hosts that are in Reduced Functionality Mode?
- A. Host Search
- B. Executive Summary dashboard
- C. Event Search
- D. Installation Tokens
正解：A
解説：
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, Reduced Functionality Mode (RFM) is a state where a host's sensor has limited functionality due to various reasons, such as license expiration, network issues, tampering attempts, etc1. You can find hosts that are in RFM by using the Host Search tool and filtering by Sensor Status = RFM1. You can also view details about why a host is in RFM by clicking on its hostname1.
質問 # 21
How does a DNSRequest event link to its responsible process?
- A. Via its TargetProcessld_decimal field
- B. Via both its ContextProcessld__decimal and ParentProcessld_decimal fields
- C. Via its ContextProcessld_decimal field
- D. Via its ParentProcessld_decimal field
正解：C
解説：
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, a DNSRequest event contains information about a DNS query made by a process2. The event has several fields, such as DomainName, QueryType, QueryResponseCode, etc2. The field that links a DNSRequest event to its responsible process is ContextProcessId_decimal, which contains the decimal value of the process ID of the process that generated the event2. You can use this field to trace the process lineage and identify malicious or suspicious activities2.
質問 # 22
You are notified by a third-party that a program may have redirected traffic to a malicious domain. Which Falcon page will assist you in searching for any domain request information related to this notice?
- A. Investigate
- B. Discover
- C. Falcon X
- D. Spotlight
正解：A
解説：
Explanation
According to the [CrowdStrike website], the Investigate page is where you can search for and analyze various types of data collected by the Falcon platform, such as events, hosts, processes, hashes, domains, IPs, etc1. You can use various tools, such as Event Search, Host Search, Process Timeline, Hash Search, Bulk Domain Search, etc., to perform different types of searches and view the results in different ways1. If you want to search for any domain request information related to a notice from a third-party, you can use the Investigate page to do so1. For example, you can use the Bulk Domain Search tool to search for the malicious domain and see which hosts and processes communicated with it1. You can also use the Event Search tool to search for DNSRequest events that contain the malicious domain and see more details about the query and response1.
質問 # 23
You are reviewing the raw data in an event search from a detection tree. You find a FileOpenlnfo event and want to find out if any other files were opened by the responsible process. Which two field values do you need from this event to perform a Process Timeline search?
- A. ParentProcessld_decimal and aid
- B. TargetProcessld_decimal and aid
- C. ResponsibleProcessld_decimal and aid
- D. ContextProcessld_decimal and aid
正解：B
解説：
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Process Timeline tool allows you to view all cloudable events associated with a given process, such as process creation, network connections, file writes, registry modifications, etc2. The tool requires two parameters: aid (agent ID) and TargetProcessId_decimal (the decimal value of the process ID)2. These fields can be obtained from any event that involves the process, such as a FileOpenInfo event, which contains information about a file being opened by a process2.
質問 # 24
From the Detections page, how can you view 'in-progress' detections assigned to Falcon Analyst Alex?
- A. Filter on'Analyst: Alex'
- B. Filter on 'Status: In-Progress' and 'Assigned-to: Alex*
- C. Alex does not have the correct role permissions as a Falcon Analyst to be assigned detections
- D. Filter on 'Hostname: Alex' and 'Status: In-Progress'
正解：B
解説：
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, the Detections page allows you to view and manage detections generated by the CrowdStrike Falcon platform2. You can use various filters to narrow down the detections based on criteria such asstatus, severity, tactic, technique, etc2. To view 'in-progress' detections assigned to Falcon Analyst Alex, you can filter on 'Status: In-Progress' and 'Assigned-to: Alex*'2. The asterisk (*) is a wildcard that matches any characters after Alex2.
質問 # 25
What does pivoting to an Event Search from a detection do?
- A. It gives you the ability to search for similar events on other endpoints quickly
- B. It allows you to input an event type, such as DNS Request or ASEP write, and search for those events within the detection
- C. It takes you to the raw Insight event data and provides you with a number of Event Actions
- D. It takes you to a Process Timeline for that detection so you can see all related events
正解：C
解説：
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, pivoting to an Event Search from a detection takes you to the raw Insight event data and provides you with a number of Event Actions1. Insight events are low-level events that are generated by the sensor for various activities, such as process executions, file writes, registry modifications, network connections, etc1. You can view these events in a table format and use various filters and fields to narrow down the results1. You can also select one or more events and perform various actions, such as show a process timeline, show a host timeline, show associated event data, show a +/- 10-minute window of events, etc1. These actions can help you investigate and analyze events more efficiently and effectively1.
質問 # 26
How long are quarantined files stored on the host?
- A. 45 Days
- B. 30 Days
- C. Quarantined files are never deleted from the host
- D. 90 Days
正解：C
解説：
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, quarantined files are never deleted from the host unless you manually delete them or release them from quarantine2. When you release a file from quarantine, you are restoring it to its original location and allowing it to execute on any host in your organization2. This action also removes the file from the quarantine list and deletes it from the CrowdStrike Cloud2.
質問 # 27
When examining a raw DNS request event, you see a field called ContextProcessld_decimal. What is the purpose of that field?
- A. It contains the TargetProcessld_decimal value for other related events
- B. It contains the TargetProcessld_decimal value for the process that made the DNS request
- C. It contains the ContextProcessld_decimal value for the parent process that made the DNS request
- D. It contains an internal value not useful for an investigation
正解：B
解説：
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the ContextProcessld_decimal field contains the decimal value of the process ID of the process that generated the event1. This field can be used to trace the process lineage and identify malicious or suspicious activities1. For a DNS request event, this field indicates which process made the DNS request1.
質問 # 28
How are processes on the same plane ordered (bottom 'VMTOOLSD.EXE' to top CMD.EXE')?
- A. Process ID (Descending, highest on bottom)
- B. Time started (Ascending, most recent on top)
- C. Time started (Descending, most recent on bottom)
- D. Process ID (Ascending, highest on top)
正解：C
解説：
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the process tree view provides a visualization of program ancestry, which shows the parent-child and sibling relationships among the processes1. You can also see the event types and timestamps for each process1. The processes on the same plane are ordered by time started in descending order, meaning that the most recent process is at the bottom and the oldest process is at the top1. For example, in the image you sent me, CMD.EXE is the oldest process and VMTOOLSD.EXE is the most recent process on that plane1.
質問 # 29
Which is TRUE regarding a file released from quarantine?
- A. No executions are allowed for 14 days after release
- B. It is deleted
- C. It will not generate future machine learning detections on the associated host
- D. It is allowed to execute on all hosts
正解：D
解説：
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, when you release a file from quarantine, you are restoring it to its original location and allowing it to execute on any host in your organization2. This action also removes the file from the quarantine list and deletes it from the CrowdStrike Cloud2.
質問 # 30
......
正真正銘で最適な資料CCFR-201オンライン練習試験：https://www.passtest.jp/CrowdStrike/CCFR-201-shiken.html
優質なCCFR-201問題集と解釈はあなたを待ってます。今すぐゲットせよ：https://drive.google.com/open?id=1t8mucBKkCY-HNkVIa-sk_WuCTVjlXCRt