CrowdStrike CCFR-201 Exam Practice Questions (P. 2)

GPT-4o - Answer

When you set up an IOA (Indicator of Attack) exclusion in CrowdStrike Falcon, this action effectively suppresses the associated detection notifications and also allows the specified processes to run. This setting is crucial when you are dealing with false positives, or trusted applications that behave in a way which might normally trigger a detection. Exclusions help tailor Falcon's monitoring to better fit the context of your environment without compromising on necessary alerts.

GPT-4o - Answer

Great going! Event Actions in CrowdStrike terminology are indeed pivotable hyperlinks located within a Host Search. These hyperlinks are particularly useful because they allow users to navigate between events seamlessly, facilitating deeper investigations and quicker analyses. Even though some argue that Event Actions can pivot from an Event Search, as indicated by other resources, the primary association with Host Search is what we focus on for understanding the correct application in this context.

GPT-4o - Answer

In CrowdStrike environments, when files are flagged and quarantined by the system for security purposes, they're specifically stored in the "Windows\System32\Drivers\CrowdStrike\Quarantine" directory. This designated quarantine path ensures isolated storage, minimizing the risk of malicious file execution while retaining the files for further analysis or restoration if needed.

GPT-4o - Answer

Absolutely on point—CrowdStrike indeed retains detection data in the cloud for a period of 90 days before it's scheduled for purging. This comprehensive span allows ample time for a thorough analysis and investigation of any detected threats. Remember, data on the host side is kept for a shorter duration, specifically 30 days, making cloud storage even more critical for ongoing security assessments.

GPT-4o - Answer

The choice of using a Process Timeline primarily offers the advantage of providing a visual representation of Parent-Child and Sibling process relationships. This kind of visualization is especially beneficial for analysts as it allows them to see how processes interact with one another, how they were started, and the hierarchy of processes, which is crucial for a clear contextual understanding during an investigation of suspicious activities. This helps in tracing back the root and the sequence of events leading to an issue.