CCFR-201b 実際試験問題と解答 - 模擬練習 - 受験自信を増やす

Question No : 1
What role does collaboration play in event investigation?

A.It is unnecessary and slows down the process
B.It allows for sharing of tasks and expertise
C.It complicates decision-making
D.It focuses only on legal aspects

正解:

Question No : 2
Which use cases are supported by applying ATT&CK techniques within Falcon workflows? (Choose two)

A.Tuning machine learning exclusion rules
B.Building behavioral rules for custom detections
C.Understanding lateral movement indicators
D.Automatically launching sandbox detonations

正解:

Question No : 3
What is the benefit of using the "Advanced Search" feature in the Event Search module?

A.It allows for free-text searches only
B.It streamlines queries using pre-defined templates
C.It enables more complex filtering and querying
D.It restricts results to specific time frames only

正解:

Question No : 4
What two types of contextual event data can be viewed in the Full Detection View? (Choose two)

A.Falcon sensor version
B.File path
C.Command-line arguments
D.Machine learning confidence score

正解:

Question No : 5
What is the primary purpose of the MITRE ATT&CK® Framework?

A.To provide a set of guidelines for cybersecurity policies
B.To serve as a comprehensive knowledge base of adversary tactics and techniques
C.To endorse specific security products and vendors
D.To offer a framework for business continuity planning

正解:

Question No : 6
Which search type should be used to investigate whether a suspicious executable has affected multiple hosts?

A.Host Search
B.Hash Search
C.User Search
D.Bulk Domain Search

正解:

Question No : 7
Which Falcon feature allows analysts to perform advanced searches across endpoint data?

A.Falcon Discover
B.Falcon Overwatch
C.Falcon Intelligence
D.Event Search

正解:

Question No : 8
Which of the following components is not part of the MITRE ATT&CK® Framework?

A.Techniques
B.Procedures
C.Threat actors
D.Policies

正解:

Question No : 9
What is the primary benefit of using Falcon Real Time Response (RTR) during an incident response?

A.It provides historical data for analysis.
B.It allows for immediate remediation on endpoints.
C.It automates responses to all alerts.
D.It eliminates the need for human analysis.

正解:

Question No : 10
Which statement is true about running event searches in Falcon?

A.Searches can only be run for the last 7 days
B.Searches are only permitted by Super Admins
C.Saved queries can be reused across investigations
D.Event searches include identity mapping features

正解:

Question No : 11
The __________ feature in Falcon enables analysts to trace a user’s activity across multiple hosts and correlate it with detections.

A.Host Search
B.User Search
C.Detection Summary
D.Event Explorer

正解:

Question No : 12
Which scenario justifies using Host Timeline over Process Timeline?

A.Investigating a single parent process only
B.Correlating telemetry from one process
C.Reviewing endpoint-wide events across all users
D.Capturing web traffic behavior

正解:

Question No : 13
A(n) ___________ is a unique artifact like a hash or domain that can be used to identify malicious activity in Falcon.

A.IOC
B.CSV
C.TTP
D.OSINT

正解:

Question No : 14
Which search capability in Falcon allows investigators to identify anomalies across multiple endpoints by applying filters and grouping criteria?

A.Basic Search
B.Network Search
C.Filtered Search
D.Correlation Search

正解:

Question No : 15
In detection analysis, what does a false positive indicate?

A.A real security threat has been identified
B.No threat exists, but an alert was triggered
C.The system is functioning as expected
D.An actual breach occurred

正解:

CrowdStrike CCFR-201b 問題練習