CrowdStrike CCFR-201問題集で必ず試験合格させる
CCFR-201試験問題（更新されたのは2025年）100%リアル問題解答
質問 # 35
Which of the following tactic and technique combinations is sourced from MITRE ATT&CK information?
- A. Machine Learning via Cloud-Based ML
- B. Falcon Intel via Intelligence Indicator - Domain
- C. Credential Access via OS Credential Dumping
- D. Malware via PUP
正解：C
解説：
Explanation
According to the [MITRE ATT&CK website], MITRE ATT&CK is a knowledge base of adversary behaviors and techniques based on real-world observations. The knowledge base is organized into tactics and techniques, where tactics are the high-level goals of an adversary, such as initial access, persistence, lateral movement, etc., and techniques are the specific ways an adversary can achieve those goals, such as phishing, credential dumping, remote file copy, etc. Credential Access via OS Credential Dumping is an example of a tactic and technique combination sourced from MITRE ATT&CK information, which describes how adversaries can obtain credentials from operating system memory or disk storage by using tools such as Mimikatz or ProcDump.
質問 # 36
Which option indicates a hash is allowlisted?
- A. Ignore
- B. No Action
- C. Always Block
- D. Allow
正解：D
解説：
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, the allowlist feature allows you to exclude files or directories from being scanned or blocked by CrowdStrike's machine learning engine or indicators of attack (IOAs)2. This can reduce false positives and improve performance2. When you allowlist a hash, you are allowing that file to execute on any host that belongs to your organization's CID (customer ID)2. The option to indicate that a hash is allowlisted is "Allow"2.
質問 # 37
How long does detection data remain in the CrowdStrike Cloud before purging begins?
- A. 14 Days
- B. 90 Days
- C. 30 Days
- D. 45 Days
正解：B
解説：
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, detection data is stored in the CrowdStrike Cloud for 90 days before purging begins2. This means that you can access and view detections from the past 90 days using the Falcon platform or API2. If you want to retain detection data for longer than 90 days, you can use FDR to replicate it to your own storage system2.
質問 # 38
How does a DNSRequest event link to its responsible process?
- A. Via both its ContextProcessld__decimal and ParentProcessld_decimal fields
- B. Via its ContextProcessld_decimal field
- C. Via its TargetProcessld_decimal field
- D. Via its ParentProcessld_decimal field
正解：B
解説：
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, a DNSRequest event contains information about a DNS query made by a process2. The event has several fields, such as DomainName, QueryType, QueryResponseCode, etc2. The field that links a DNSRequest event to its responsible process is ContextProcessId_decimal, which contains the decimal value of the process ID of the process that generated the event2. You can use this field to trace the process lineage and identify malicious or suspicious activities2.
質問 # 39
How are processes on the same plane ordered (bottom 'VMTOOLSD.EXE' to top CMD.EXE')?
- A. Time started (Descending, most recent on bottom)
- B. Time started (Ascending, most recent on top)
- C. Process ID (Descending, highest on bottom)
- D. Process ID (Ascending, highest on top)
正解：A
解説：
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the process tree view provides a visualization of program ancestry, which shows the parent-child and sibling relationships among the processes1. You can also see the event types and timestamps for each process1. The processes on the same plane are ordered by time started in descending order, meaning that the most recent process is at the bottom and the oldest process is at the top1. For example, in the image you sent me, CMD.EXE is the oldest process and VMTOOLSD.EXE is the most recent process on that plane1.
質問 # 40
When looking at the details of a detection, there are two fields called Global Prevalence and Local Prevalence.
Which answer best defines Local Prevalence?
- A. Local prevalence is the frequency with which the hash of the triggering file is seen across the entire Internet
- B. Local Prevalence is the Virus Total score for the hash of the triggering file
- C. Local Prevalence tells you how common the hash of the triggering file is within your environment (CID)
- D. Local prevalence is the frequency with which the hash of the triggering file is seen across all CrowdStrike customer environments
正解：C
解説：
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, Global Prevalence and Local Prevalence are two fields that provide information about how common or rare a file is based on its hash value2. Global Prevalence tells you how frequently the hash of the triggering file is seen across all CrowdStrike customer environments2. Local Prevalence tells you how frequently the hash of the triggering file is seen within your environment (CID)2. These fields can help you assess the risk and impact of a detection2.
質問 # 41
What is the difference between a Host Search and a Host Timeline?
- A. A Host Timeline only includes process execution events and user account activity
- B. There is no difference - Host Search and Host Timeline are different names for the same search page
- C. Results from a Host Search return information in an organized view by type, while a Host Timeline returns a view of all events recorded by the sensor
- D. Results from a Host Timeline include process executions and related events organized by data type. A Host Search returns a temporal view of all events for the given host
正解：C
解説：
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Host Search allows you to search for hosts based on various criteria, such as hostname, IP address, OS, etc1. The results are displayed in an organized view by type, such as detections, incidents, processes, network connections, etc1. The Host Timeline allows you to view all events recorded by the sensor for a given host in a chronological order1. The events include process executions, file writes, registry modifications, network connections, user logins, etc1.
質問 # 42
Within the MITRE-Based Falcon Detections Framework, what is the correct way to interpret Keep Access > Persistence > Create Account?
- A. An adversary is trying to keep access through persistence using external remote services
- B. adversary is trying to keep access through persistence using application skimming
- C. An adversary is trying to keep access through persistence by creating an account
- D. An adversary is trying to keep access through persistence using browser extensions
正解：C
解説：
Explanation
According to the [CrowdStrike website], the MITRE-Based Falcon Detections Framework is a way of categorizing and describing detections based on the MITRE ATT&CK knowledge base ofadversary behaviors and techniques. The framework uses three levels of granularity: category, tactic, and technique. The category is the highest level and represents the main objective of an adversary, such as initial access, execution, credential access, etc. The tactic is the second level and represents the sub-objective of an adversary within a category, such as persistence, privilege escalation, defense evasion, etc. The technique is the lowest level and represents the specific way an adversary can achieve a tactic, such as create account, modify registry, obfuscated files or information, etc. Therefore, the correct way to interpret Keep Access > Persistence > Create Account is that an adversary is trying to keep access through persistence by creating an account.
質問 # 43
What types of events are returned by a Process Timeline?
- A. Only network events
- B. Only detection events
- C. All cloudable events
- D. Only process events
正解：C
解説：
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Process Timeline search returns all cloudable events associated with a given process, such as process creation, network connections, file writes, registry modifications, etc1. This allows you to see a comprehensive view of what a process was doing on a host1.
質問 # 44
Which of the following is NOT a filter available on the Detections page?
- A. Severity
- B. Time
- C. Triggering File
- D. CrowdScore
正解：C
解説：
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, the Detections page allows you to view and manage detections generated by the CrowdStrike Falcon platform2. You can use various filters to narrow down the detections based on criteria such as severity, CrowdScore, time, tactic, technique, etc2. However, there is no filter for triggering file, which is the file that caused the detection2.
質問 # 45
The Process Activity View provides a rows-and-columns style view of the events generated in a detection.
Why might this be helpful?
- A. The Process Activity View creates a consolidated view of all detection events for that process that can be exported for further analysis
- B. The Process Activity View creates a count of event types only, which can be useful when scoping the event
- C. The Process Activity View only creates a summary of Dynamic Link Libraries (DLLs) loaded by a process
- D. The Process Activity View will show the Detection time of the earliest recorded activity which might indicate first affected machine
正解：A
解説：
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Process Activity View allows you to view all events generated by a process involved in a detection in a rows-and-columns style view1. This can be helpful because it creates a consolidated view of all detection events for that process that can be exported for further analysis1. You can also sort, filter, and pivot on the events by various fields, such as event type, timestamp, file name, registry key, network destination, etc1.
質問 # 46
In the "Full Detection Details", which view will provide an exportable text listing of events like DNS requests.
Registry Operations, and Network Operations?
- A. View as Process Tree
- B. View as Process Timeline
- C. View as Process Activity
- D. Thedata is unable to be exported
正解：C
解説：
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Full Detection Details tool allows you to view detailed information about a detection, such as detection ID, severity, tactic, technique, description, etc1. You can also view the events generated by the processes involved in the detection in different ways, such as process tree, process timeline, or process activity1. The process activity view provides a rows-and-columns style view of the events, such as DNS requests, registry operations, network operations, etc1. You can also export this view to a CSV file for further analysis1.
質問 # 47
After pivoting to an event search from a detection, you locate the ProcessRollup2 event. Which two field values are you required to obtain to perform a Process Timeline search so you can determine what the process was doing?
- A. aid and TargetProcessld_decimal
- B. SHA256 and TargetProcessld_decimal
- C. aid and ParentProcessld_decimal
- D. SHA256 and ParentProcessld_decimal
正解：A
解説：
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Process Timeline search requires two parameters: aid (agent ID) and TargetProcessId_decimal (the decimal value of the process ID). These fields can be obtained from the ProcessRollup2 event, which contains information about processes that have executed on a host1.
質問 # 48
When reviewing a Host Timeline, which of the following filters is available?
- A. Detection ID
- B. Event Types
- C. User Name
- D. Severity
正解：B
解説：
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Host Timeline tool allows you to view all events recorded by the sensor for a given host in a chronological order1. The events include process executions, file writes, registry modifications, network connections, user logins, etc1. You can use various filters to narrow down the events based on criteria such as event type, timestamp range, file name, registry key, network destination, etc1. However, there is no filter for severity, user name, or detection ID, as these are not attributes of the events1.
質問 # 49
What happens when a hash is set to Always Block through IOC Management?
- A. Execution is prevented on selected host groups
- B. Execution is prevented and detection alerts are suppressed
- C. Execution is prevented on all hosts by default
- D. The hash is submitted for approval to be blocked from execution once confirmed by Falcon specialists
正解：C
解説：
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, IOC Management allows you to manage indicators of compromise (IOCs), which are artifacts such as hashes, IP addresses, or domains that are associated with malicious activities2. You can set different actions for IOCs, such as Allow, No Action, or Always Block2. When you set a hash to Always Block through IOC Management, you are preventing that file from executing on any host in your organization by default2. This action also generates a detection alert when the file is blocked2.
質問 # 50
How long are quarantined files stored on the host?
- A. Quarantined files are never deleted from the host
- B. 90 Days
- C. 30 Days
- D. 45 Days
正解：A
解説：
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, quarantined files are never deleted from the host unless you manually delete them or release them from quarantine2. When you release a file from quarantine, you are restoring it to its original location and allowing it to execute on any host in your organization2. This action also removes the file from the quarantine list and deletes it from the CrowdStrike Cloud2.
質問 # 51
The Falcon platform will show a maximum of how many detections per day for a single Agent Identifier (AID)?
- A. 0
- B. 1
- C. 2
- D. 3
正解：D
解説：
Explanation
According to the CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, the Falcon platform will show a maximum of 1000 detections per day for a single AID1. This is a limitimposed by the Falcon API, which is used to retrieve the detections from the CrowdStrike Cloud1. If there are more than 1000 detections per day for a single AID, only the first 1000 will be shown1.
質問 # 52
What does pivoting to an Event Search from a detection do?
- A. It allows you to input an event type, such as DNS Request or ASEP write, and search for those events within the detection
- B. It takes you to a Process Timeline for that detection so you can see all related events
- C. It takes you to the raw Insight event data and provides you with a number of Event Actions
- D. It gives you the ability to search for similar events on other endpoints quickly
正解：C
解説：
Explanation
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, pivoting to an Event Search from a detection takes you to the raw Insight event data and provides you with a number of Event Actions1. Insight events are low-level events that are generated by the sensor for various activities, such as process executions, file writes, registry modifications, network connections, etc1. You can view these events in a table format and use various filters and fields to narrow down the results1. You can also select one or more events and perform various actions, such as show a process timeline, show a host timeline, show associated event data, show a +/- 10-minute window of events, etc1. These actions can help you investigate and analyze events more efficiently and effectively1.
質問 # 53
How long are quarantined files stored in the CrowdStrike Cloud?
- A. 90 Days
- B. Days
- C. 45 Days
- D. Quarantined files are not deleted
正解：A
解説：
Explanation
According to the [CrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide], when you quarantine a file from a host using IOC Management or Real Time Response (RTR), you are moving it from its original location to a secure location on the host where it cannot be executed. The file is also encrypted and renamed with a random string of characters. A copy of the file is also uploaded to the CrowdStrike Cloud for further analysis. Quarantined files are stored in the CrowdStrike Cloud for 90 days before they are deleted.
質問 # 54
......
合格させるCrowdStrike CCFR-201試験最速合格にはFast2test：https://jp.fast2test.com/CCFR-201-premium-file.html