CCFR-201b Exam Dumps - CrowdStrike CCFR Questions and Answers

10%

20%

50%

100%

The attacker launched a command prompt, renamed binaries, executed malware, and prepared exfiltration

The attacker launched a command prompt to establish a reverse shell to grant remote code execution capabilities

The attacker executed malware, renamed binaries, prepared exfiltration, and deleted backups to prevent recovery

The attacker launched a command prompt, enumerated the host, created persistence, and deleted backups to prevent recovery

Filename-based allowlist

Hash-based allowlist

Path-based allowlist

Command-line allowlist

Process Information

Port Information

IP Lookup Information

Threat Actor Information

List of running services and drivers.

Macro Execution History for Microsoft Office products.

Recent network connections and IP addresses.

List of local user accounts and administrators.

Via both its ContextProcessld__decimal and ParentProcessld_decimal fields

Via its ParentProcessld_decimal field

Via its ContextProcessld_decimal field

Via its TargetProcessld_decimal field

ProcessTimeline Link

PID

UTCtime

Process ID or Parent Process ID

Results from a Host Search return information in an organized view by type, while a Host Timeline returns a view of all events recorded by the sensor

A Host Timeline only includes process execution events and user account activity

Results from a Host Timeline include process executions and related events organized by data type. A Host Search returns a temporal view of all events for the given host

There is no difference - Host Search and Host Timeline are different names for the same search page

ParentProcessld_decimal and aid

ResponsibleProcessld_decimal and aid

ContextProcessld_decimal and aid

TargetProcessld_decimal and aid

Command Line

User Name

HTTP Post contents

SHA256 Hash