Crowdstrike Certified Falcon Responder Free Sample Questions

Event Investigation · Explain what information a Host Timeline will provide

1. A

   Use Event Search to look for all svchost.exe executions across the environment.

2. B

   Perform a User Search for the user account associated with the svchost.exe process to check for other suspicious logins.

3. C

   Connect to the host with Real Time Response (RTR) and run the ps command to list running processes.

4. D

   Pivot to the Host Timeline and look for events that occurred immediately prior to the network connection, such as Service Creation or Registry modifications.

Real Time Response (RTR) · Investigate a threat within Falcon and use RTR commands to remediate it

1. A
   1. runscript -CloudFile="Get-FileHandle" -CommandLine="C:\Users\Public\artifact.exe" 2. kill 3. get C:\Users\Public\artifact.exe
2. B
   1. ps 2. xmemdump 3. get C:\Users\Public\artifact.exe
3. C
   1. run Get-FileHandle -CommandLine="C:\Users\Public\artifact.exe" 2. kill 3. get C:\Users\Public\artifact.exe
4. D
   1. ls -l C:\Users\Public\ 2. memdump 3. get C:\Users\Public\artifact.exe

Detection Analysis · Explain the effects of machine learning exclusion rules, sensor visibility exclusions, and IOA exclusions

1. A

   Create an IOA Exclusion for that IOA, limited to the app's path and command line.

2. B

   Add the application's hash to the custom IOCs with an action of 'Allow'.

3. C

   Create a Sensor Visibility Exclusion for the application's executable.

4. D

   Create a Machine Learning Exclusion for the application executable.

Event Search · Perform an Advanced Event Search from a detection and refine a search using event actions

1. A

   event_platform=Win

2. B

   #event_simpleName=Win

3. C

   ImageFileName=/Windows/i

4. D

   ComputerName=Win

ATT&CK Framework Application · Apply MITRE ATT&CK tactics and techniques within Falcon to provide context to a detection

1. A

   The adversary is escalating privileges from a standard user to an administrator.

2. B

   The adversary has successfully exfiltrated data from the host.

3. C

   The adversary is attempting to discover other hosts on the network.

4. D

   The adversary set their code to run automatically at system boot or user logon.

Search Tools · Analyze the information provided in a Bulk Domain Search

1. A

   True

2. B

   False

Real Time Response (RTR) · Investigate a threat within Falcon and use RTR commands to remediate it

1. A

   Run a raw script with runscript -Raw that contains netstat -anp

2. B

   get /tmp/connections.txt

3. C

   Run a raw script with runscript -Raw that contains netstat -anp > /tmp/connections.txt

4. D

   Run a raw script with runscript -Raw that contains netstat -anp >> /dev/null

Search Tools · Analyze the information provided in Host Search results

1. A

   Current CPU and Memory utilization

2. B

   Last Seen Timestamp

3. C

   List of installed applications

4. D

   Sensor Version

5. E

   Currently applied Prevention Policy

Event Investigation · Explain what information a Process Timeline will provide

1. A

   User Search for the associated user

2. B

   Host Timeline

3. C

   Process Timeline

4. D

   Event Search with the process's filename

ATT&CK Framework Application · Apply MITRE ATT&CK tactics and techniques within Falcon to provide context to a detection

1. A

   Exfiltration (TA0010)

2. B

   Collection (TA0009)

3. C

   Discovery (TA0007)

4. D

   Impact (TA0040)