100% Free CCFR-201b Practice Exam Questions and Answers

Stay Ahead with Latest CCFR-201b CrowdStrike Falcon Practice Test Questions 2026

Page: 1 / 12

Total 60 Questions | Updated On: Oct 25, 2026

Add To Cart

Question 1

Where can you find hosts that are in Reduced Functionality Mode?

A : Event Search

B : Executive Summary dashboard

C : Host Search

D : Installation Tokens

Answer: C

Question 2

What happens when you open the full detection details?

A : The process explorer opens and the detection is removed from the console

B : The process explorer opens and you’re able to view the processes and process relationships

C : The process explorer opens and the detection copies to the clipboard

D : The process explorer opens and the Event Search query is run for the detection

Answer: B

Question 3

From a detection, what is the fastest way to see children and sibling process information?

A : Select the Event Search option. Then from the Event Actions, select Show Associated Event Data (From TargetProcessId_decimal)

B : Select Full Detection Details from the detection

C : Right-click the process and select "Follow Process Chain"

D : Select the Process Timeline feature, enter the AID, Target Process ID, and Parent Process ID

Answer: C

Question 4

You are reviewing the raw data in an event search from a detection tree. You find a FileOpenInfo event and want to find out if any other files were opened by the responsible process. Which two field values do you need from this event to perform a Process Timeline search?

A : ParentProcessId_decimal and aid

B : ResponsibleProcessId_decimal and aid

C : ContextProcessId_decimal and aid

D : TargetProcessId_decimal and aid

Answer: B

Question 5

What action is used when you want to save a prevention hash for later use?

A : Always Block

B : Never Block

C : Always Allow

D : No Action

Answer: A

Page: 1 / 12

Total 60 Questions | Updated On: Oct 25, 2026

Add To Cart