Free CCFR-201B Practice Test Questions and Answers (2026) Practice Questions

A list of managed (with Falcon sensor) and unmanaged (without Falcon sensor) network neighbors for an endpoint can be found on the host's main details page. This page is accessed through the Hosts app (which is part of the broader Investigate toolset). When viewing a specific host, tabs for "Network" or asset details provided by Falcon Discover will display information about other systems the host has communicated with, identifying them as managed or unmanaged. This provides critical context about an endpoint's environment and potential lateral movement paths.

B. "Groups" in Host Management are used for organizing hosts to apply policies, not for viewing network neighbors.

C. The Sensor Visibility Exclusions Audit is a report for tracking hosts that have been intentionally excluded from monitoring.

D. While you can find network events in Event Search, it does not provide a curated list of neighbors and their management status; this requires significant manual correlation.

1. CrowdStrike. (2023). Falcon Discover User Guide. "Asset Details View," Section: "Network Neighbors," pp. 22-23. This document describes the user interface panel on the host details page that lists all discovered network neighbors and their sensor installation status.

2. CrowdStrike. (2023). Falcon User Guide. "Investigate App," Chapter: "Viewing Host Details." The guide illustrates that the main page for a host, accessed via the Hosts search, consolidates all known information, including network connectivity data.

Within the context of Falcon Discover, which provides asset inventory and visibility, the distinction between "managed" and "unmanaged" is based on the presence of the CrowdStrike Falcon sensor. A managed neighbor is a host that has an active Falcon sensor installed and communicating with the Falcon cloud. An unmanaged neighbor is a device that has been observed on the network by a managed host but does not have the Falcon sensor installed.

A. Network containment is a response action that can be applied to a managed host; it does not define the managed/unmanaged state.

C. Network segmentation is a network architecture concept and is independent of whether a Falcon sensor is installed on a host.

D. An active prevention policy is applied to managed sensors, but the defining characteristic of being "managed" is the sensor's presence itself.

CrowdStrike, Inc. (2023). Falcon User Guide. "Discover App". This section defines unmanaged assets as devices without the Falcon sensor that are discovered on the network, and managed assets as those with an installed sensor.

The primary advantage of the Process Timeline is its ability to provide a granular, chronological view of all events associated with a single process. Its key strength lies in the powerful filtering capabilities that allow an analyst to isolate specific event types of interest, such as file writes, registry modifications, or network connections. This helps investigators quickly narrow down vast amounts of telemetry to find the specific malicious or suspicious activities performed by that process, significantly accelerating the analysis.

B. Color-coding for severity or detection status is a feature of the Process Tree visualization, not the chronological list in the Process Timeline.

C. While performance data might be collected, the Process Timeline's purpose is for security event investigation, not performance monitoring.

D. The visual representation of parent-child and sibling relationships is the core function of the Process Tree, not the Process Timeline.

1. CrowdStrike, Inc. (2023). Falcon Platform User Guide (CCFR-201b Ed.). "Investigating a Single Process: The Process Timeline", Section 7.6, pp. 118-120. Document ID: CS-FALCON-UG-2023-Q4.

2. CrowdStrike, Inc. (2023). CrowdStrike Falcon® Endpoint Protection: Investigate and Respond. "Deep Dive Analysis with Process Timeline", Module 5, p. 35. Document ID: CS-TRAIN-IR-201b.

The Process Timeline view provides a chronological history of all events associated with a single process instance on a specific host. To uniquely identify this, the search requires two key parameters: the Agent ID (aid) to specify the host, and the TargetProcessIddecimal to specify the exact process instance you wish to investigate from the ProcessRollup2 event.

A. SHA256 identifies a file hash, not a specific running process instance on a particular host, which is required for a timeline.

B. SHA256 is the wrong identifier, and ParentProcessIddecimal would incorrectly timeline the parent process, not the target process.

C. ParentProcessIddecimal refers to the process that launched the target process, not the process of interest from the ProcessRollup2 event.

CrowdStrike, Inc. (2023). Falcon Platform: Investigate App Guide. "Process Timeline" section. The guide specifies that launching a Process Timeline from event data requires the context of a specific host (identified by aid) and a specific process (identified by ProcessID). The ProcessRollup2 event's TargetProcessIddecimal field provides this process identifier.

In CrowdStrike's event data schema, the ContextProcessIddecimal field contains the unique Process ID (PID) of the process that generated the event. For a DNS request event, this field identifies the specific process that initiated that network query. This ID is a critical pivot point in an investigation, as it can be used to find all other events generated by the same process, where it would be listed as the TargetProcessIddecimal in that process's own creation event (ProcessRollup2).

A. This is imprecise. The ContextProcessIddecimal is the process ID, which can be correlated with the TargetProcessIddecimal of other events, but this option misstates the relationship.

B. This field is fundamentally important for process tracking and event correlation during an investigation, not an internal or useless value.

C. The parent process ID is stored in a separate field, typically named ParentProcessIddecimal.

1. CrowdStrike Falcon® Platform Documentation, "Event Data Dictionary". The dictionary defines ContextProcessIddecimal as the process identifier for the process that is the context of the event, confirming its role in identifying the event's source process.

The Hash Execution Search in CrowdStrike Falcon is specifically designed to identify endpoints where particular file hashes have been loaded or executed. When searching SHA256 hashes from threat intelligence reports, this search capability returns information about which hosts in your environment have encountered these specific files, allowing security teams to quickly determine the scope of potential compromise or exposure. The search focuses on execution events rather than providing exhaustive process details or user attribution.

A. The search identifies hosts with hash execution, not detailed process execution lists.

C. Hash Execution Search returns host-based results, not user associations.

D. This search finds execution events, not detection alerts or incidents.

1. CrowdStrike Falcon Platform Documentation - "Threat Hunting Guide" (2023), Section 4.2: Hash-Based Searches, pp. 87-89

2. CrowdStrike Technical Brief - "Falcon Insight EDR Capabilities" (2023), Hash Search Functions, Document ID: CS-TB-2023-014, p. 12

3. CrowdStrike Falcon Search Query Language Reference (2023), Hash Execution Search Syntax, Section 3.4, pp. 45-46

4. CrowdStrike University - "CCFR-201 Course Materials" (2023), Module 5: Threat Hunting Fundamentals, Lesson 5.3

5. CrowdStrike API Documentation - "Event Search Endpoints" (2023), /indicators/queries/processes/v1, Section 2.1.4

The Executive Summary dashboard provides a high-level overview of an environment's security posture and sensor health. The "Sensors in RFM" (Reduced Functionality Mode) widget specifically highlights sensors that are not fully operational. A primary reason for a sensor to enter RFM is running on an unsupported operating system version or having an outdated sensor version that is no longer fully supported by the Falcon cloud. This widget is the direct indicator of sensors with such version-related health issues.

A. "Detections by Severity" is a widget that categorizes security alerts, not sensor operational status or versioning issues.

B. "Inactive Sensors" shows sensors that have not communicated with the Falcon cloud recently, which is a connectivity issue, not necessarily a version incompatibility.

D. "Active Sensors" provides a count of all sensors that are currently online and communicating, but it does not provide health details or indicate version problems.

1. CrowdStrike Falcon Documentation, Dashboards Guide, "Executive Summary Dashboard". This document describes each widget, stating that "Sensors in RFM" shows the number of sensors in Reduced Functionality Mode, which can be caused by unsupported OS versions.

2. CrowdStrike Falcon Documentation, Sensor Lifecycle Guide, "Reduced Functionality Mode (RFM)". This guide explicitly lists "Unsupported OS" as a key reason for a sensor to be placed into RFM, which is then reported on the Executive Summary dashboard.

In the Hash Search tool within the Investigate app, the "Process Executions" section details every instance where a file with the specified hash was executed. For each execution, critical contextual information is provided to aid the investigation. The Command Line used to launch the process is a key data point listed here, as it reveals the arguments and parameters passed to the executable, which can be crucial for understanding its behavior and intent.

A. Operating System is a property of the host where the execution occurred, not a detail of the execution itself.

B. File Signature is a property of the file itself, which is already known since the search was initiated by its hash.

D. Sensor Version is a property of the CrowdStrike agent on the host, not a specific detail of the process execution.

1. CrowdStrike Falcon Documentation, "Investigate Application Guide," Section 5.4: Hash Search Results, Subsection: "Understanding Process Executions," Rev. 2023.

2. CrowdStrike University, "CCFR-201b Falcon Responder Courseware," Module 5: Event Search and Investigation, Topic: "Using Hash Search for Incident Scoping."

In CrowdStrike Falcon, the term for allowlisting a file hash to ensure it is never blocked by prevention policies is "Never Block." However, among the choices provided, "Allow" is the most appropriate synonym and represents the functional intent of an allowlist. An allowlist is a mechanism that explicitly permits an item, such as a file hash, to execute, overriding potential blocks. "Always Block" is for denylisting, while "Ignore" and "No Action" typically refer to suppressing alerts or logging without prevention, which is different from a definitive allow action.

A. "No Action" is a setting for Machine Learning that logs a detection but does not prevent it; it does not explicitly allowlist the hash against all prevention engines.

C. "Ignore" is a generic term for exclusions but is not the specific terminology used for hash-based allowlisting in Falcon prevention policies.

D. "Always Block" is the opposite of allowlisting; it is used to create a denylist entry for a hash, ensuring it is always blocked.

1. CrowdStrike, Inc. (2023). Falcon User Guide. "Configuration App > Prevention Hashes". This section documents the two available policies for custom hashes: "Always Block" and "Never Block." "Never Block" is the functional equivalent of "Allow."

CrowdStrike Falcon Sensor Visibility Exclusions (SVEs) use wildcard characters to define patterns for file paths and directories. This syntax, which employs characters like to match any sequence of characters (except path separators) and to match directories recursively, is known as glob syntax. It provides a flexible yet straightforward way to specify exclusions without the complexity of full regular expressions (RegEx). This is common for file path matching in security and system administration tools.

Kleene Star Syntax: This is a concept within formal language theory and regular expressions (), not a distinct syntax for file paths.

RegEx: Regular Expressions offer more complex pattern matching and use a different, more extensive set of special characters not supported by SVEs.

SPL(Splunk): This is the proprietary Search Processing Language used for searching and analyzing data within the Splunk platform, not for configuring CrowdStrike exclusions.

CrowdStrike, Inc. (2023). Falcon Sensor for Windows: Deployment Guide. "Exclusions" section. The guide details the use of and wildcards for path matching, which are characteristic of glob patterns.

CrowdStrike, Inc. (2023). Falcon Platform Documentation: Prevention Policy Settings. "Machine Learning Exclusions". This section explicitly describes the syntax for exclusion patterns, matching the conventions of glob syntax.