CCFR-201b 試験問題を無料オンラインアクセス

How long does detection data remain in the CrowdStrike Cloud before purging begins?

• A.30 Days
• B.45 Days
• C.14 Days
• D.90 Days

The Falcon sensor can automatically upload quarantined files to the CrowdStrike Cloud for further analysis.
What is the maximum size allowed for a quarantined file to be uploaded?

• A.32MB
• B.64MB
• C.10MB
• D.128MB

What is the difference between Managed and Unmanaged Neighbors in the Falcon console?

• A.A managed neighbor is currently network contained and an unmanaged neighbor is uncontained
• B.A managed neighbor has an installed and provisioned sensor
• C.A managed sensor has an active prevention policy
• D.An unmanaged neighbor is in a segmented area of the network

Responders often use Process Explorer to visualize process behavior. Which of the following is NOT a valid way to pivot to a Process Explorer view?

• A.From Host Search > Processes and Services list
• B.From Event Search > Click on a specific Process ID
• C.From Configuration > Prevention Policies > View Process Explorer
• D.From Detection > Top Right Drop Down > View as Process Activity

A responder is analyzing a process tree where a suspicious executable is listed as a direct child of services.
exe. In this scenario, which source is most likely responsible for the execution?

• A.An interactive user login via RDP.
• B.A web browser download initiated by the end user.
• C.A script executed directly from a removable USB drive.
• D.A Windows Service or a process launched by the Service Control Manager.