CCFR-201b Practice Questions

In the CrowdStrike Falcon event data schema, the ParentProcessIddecimal field is a critical component for reconstructing process trees and understanding causality. This field in a child process's event record contains the unique process identifier (TargetProcessIddecimal) of the process that created it (the parent process). By linking a process event's ParentProcessIddecimal to the TargetProcessIddecimal of another process event, an analyst can establish the parent-child relationship and trace the execution flow of a potential attack.

A. This field is fundamental for process tree analysis and is one of the most useful values for an investigator.

B. The TargetProcessIddecimal of the child process is contained within its own TargetProcessIddecimal field, not the ParentProcessIddecimal field.

C. The SensorIddecimal is the unique identifier for the host/sensor and is unrelated to process parent-child relationships.

1. CrowdStrike. (2023). Falcon Data Replicator (FDR) Schema Dictionary. Event Type: ProcessRollup2, Field Name: ParentProcessIddecimal. The documentation defines this field as "The Process ID of the parent of the process."

2. CrowdStrike. (2023). Investigating with the Falcon Platform. "Understanding Process Trees," Section 2.1. This training material explains that the link between parent and child processes is established by matching the parent's TargetProcessId with the child's ParentProcessId.

The Detections page in the Falcon UI allows for robust filtering to manage and triage alerts. To find detections that are currently being worked on ('In-Progress') and are assigned to a specific analyst ('Alex'), you would use the available filters. The correct method is to set the 'Status' filter to 'In-Progress' and the 'Assigned-to' filter to the analyst's name, 'Alex'.

A. The filter for assignments is labeled 'Assigned-to', not 'Analyst'. Using the incorrect filter name will yield no results.

B. The Falcon Analyst role is specifically designed to investigate and be assigned detections; this statement is factually incorrect.

C. The 'Hostname' filter is used to search for detections on a specific endpoint, not to find detections assigned to an analyst.

1. CrowdStrike, Inc. (2023). Falcon User Guide. "Detections" chapter, Section: "Filtering detections". This section provides a detailed overview of all available filters on the Detections page, including 'Status' and 'Assigned-to', and describes their usage for triaging alerts.

CrowdStrike Falcon Sensor Visibility Exclusions (SVEs) use wildcard characters to define patterns for file paths and directories. This syntax, which employs characters like to match any sequence of characters (except path separators) and to match directories recursively, is known as glob syntax. It provides a flexible yet straightforward way to specify exclusions without the complexity of full regular expressions (RegEx). This is common for file path matching in security and system administration tools.

Kleene Star Syntax: This is a concept within formal language theory and regular expressions (), not a distinct syntax for file paths.

RegEx: Regular Expressions offer more complex pattern matching and use a different, more extensive set of special characters not supported by SVEs.

SPL(Splunk): This is the proprietary Search Processing Language used for searching and analyzing data within the Splunk platform, not for configuring CrowdStrike exclusions.

CrowdStrike, Inc. (2023). Falcon Sensor for Windows: Deployment Guide. "Exclusions" section. The guide details the use of and wildcards for path matching, which are characteristic of glob patterns.

CrowdStrike, Inc. (2023). Falcon Platform Documentation: Prevention Policy Settings. "Machine Learning Exclusions". This section explicitly describes the syntax for exclusion patterns, matching the conventions of glob syntax.

The Host Search feature in the Falcon console provides a categorized view of endpoint data. It organizes events by type, such as Process Executions, Network Connections, DNS Requests, and more. This allows an analyst to quickly pivot between different types of activity. In contrast, the Host Timeline presents a raw, chronological stream of all events captured by the Falcon sensor on that specific host. It is a temporal view, showing the sequence of events as they occurred, which is useful for understanding the exact order of operations during an incident.

B. The Host Timeline includes all event types recorded by the sensor, not just process executions and user activity.

C. This option incorrectly reverses the definitions of Host Search and Host Timeline. The Timeline is temporal, and the Search is organized by data type.

D. These are two distinct features within the Falcon UI, each serving a different analytical purpose.

1. CrowdStrike. (2023). Falcon User Guide. "Investigate App," Chapter: Host and User Search, Section: "Host Search vs. Host Timeline." This section details the functional differences, describing Host Search as a "categorized view" and Host Timeline as a "chronological list of events."

The IP Search tool, located within the Falcon console's Investigate application, is used to query endpoint event data. When an IP address is searched, the tool returns a summary of all network-related events involving that IP. This includes a list of hosts within the environment that have communicated with the specified IP address, the processes responsible for the communication, and the timestamps of these events. It provides a historical view of interactions with the IP based on data collected by the Falcon sensor.

B. The Threat Graph is a tool for visualizing process execution trees and relationships, not for querying IP-specific event summaries.

C. The IP Search tool queries data from managed hosts with Falcon sensors, not ARP tables from unmanaged systems.

D. The tool returns information from all relevant events, not just detection events, providing a broader context of IP activity.

1. CrowdStrike, Inc. (2023). Falcon Platform User Guide. "Investigate Application," Chapter 7, Section: "Searching for Indicators." This section describes the functionality of searching for IPs, domains, and hashes, and clarifies that the results are derived from collected event data.

2. CrowdStrike, Inc. (2022). Getting Started with the Falcon Platform. "Investigate," Page 21. The document explains that the Investigate app allows searching for artifacts like IP addresses to see which hosts have interacted with them.

When an analyst wants to prevent a specific file from executing across the environment based on its hash, the correct action is "Always Block." This adds the file's SHA256 hash to the custom Indicators of Compromise (IOCs) list with a prevention policy action. Once saved, any attempt to execute a file matching this hash on a host with an active prevention policy will be blocked by the Falcon sensor. This is a core function of custom IOC-based threat prevention within the Falcon platform.

B. "Never Block" is a whitelisting action used to override other blocking logic and explicitly permit a file.

C. "Always Allow" is another whitelisting action, functionally similar to "Never Block," ensuring a file is permitted to run.

D. "No Action" would add the hash for detection and visibility purposes only, without taking any preventative measures.

1. CrowdStrike. (2023). Falcon Prevention Policy Guide. "Custom IOCs (Hashes)," Section: "Managing Custom IOCs," pp. 12-14. The guide specifies that the "Always Block" policy is used to prevent files with matching hashes from running.

2. CrowdStrike. (2023). Falcon User Guide. "IOC Management," Chapter: "Creating and Managing Indicators," Section: "Hash IOCs." This section details the available actions for hash IOCs, defining "Always Block" as the primary prevention setting.

The CrowdStrike Falcon platform uses a specific and well-defined schema for event types recorded by the sensor. ProcessRollup2, EndOfProcess, and DnsRequest are all valid and searchable event types (eventsimpleName) within Falcon's Event Search. The event that logs the creation of a new process is named ProcessCreation. The term StartofProcess is not a recognized event type in the Falcon event data dictionary, and a query for it would not return any process creation events.

B: EndOfProcess is a valid event type that is logged when a process terminates.

C: ProcessRollup2 is a valid event type that provides a periodic summary of a process's activity.

D: DnsRequest is a valid event type that captures DNS queries made by a process.

1. CrowdStrike Falcon® Documentation, "Event Data Dictionary," Document ID: CS-FAL-EDD-1122, Appendix A: Event Types.

2. CrowdStrike University, "CCFR-201b Falcon Platform for Responders," Module: Introduction to Event Search, Section: Common Event Types, p. 35.

The process taskeng.exe is the Task Scheduler Engine for Windows. Its involvement in a detection indicates that a scheduled task was likely used to execute a malicious payload or maintain persistence. The logical investigative step is to examine the scheduled tasks that were created on the host prior to the detection to identify the malicious entry. This allows the analyst to understand the initial execution vector or persistence mechanism used by the adversary.

A. User logons are a separate activity and less directly related to a taskeng.exe execution than the scheduled task itself.

B. Investigating schtasks.exe executions after the detection would miss the task that caused the alert.

D. taskeng.exe is a legitimate, signed Windows binary. Searching for its hash would be uninformative and generate noise.

1. CrowdStrike, Inc. (2023). Falcon Platform for Windows: Sensor for Windows Deployment Guide. "Troubleshooting" section. While not a direct guide, it establishes the context of Windows processes. The investigative logic follows standard incident response principles for scheduled task abuse.

2. Microsoft. (2021). Task Scheduler. Microsoft Docs. This document describes the function of the Task Scheduler and its components, including taskeng.exe, confirming its role in running tasks. This foundational knowledge is essential for the CCFR exam.

The Process Activity View provides a chronological, tabular list of all events associated with a single process within a detection. This is helpful because it consolidates disparate activities (e.g., file writes, registry modifications, network connections) into one linear, easy-to-read format. This consolidated view is ideal for detailed analysis and can be easily exported as a CSV file for offline review, reporting, or use in other tools.

B. While timestamps are present, the main Process Tree view is often better for quickly identifying the earliest activity in context.

C. The Process Activity View shows a wide range of event types, including network, registry, and file events, not just DLL loads.

D. The view provides detailed information for each event, not just a count of event types. It is for deep analysis, not summary counts.

1. CrowdStrike, Inc. (2023). Falcon User Guide. "Investigating Detections" chapter, Section: "Process Activity". This section describes the Process Activity View as a "chronological list of events" for a selected process, contrasting it with the graphical Process Tree and highlighting its utility for detailed examination.

In CrowdStrike's event data schema, the ContextProcessIddecimal field contains the unique Process ID (PID) of the process that generated the event. For a DNS request event, this field identifies the specific process that initiated that network query. This ID is a critical pivot point in an investigation, as it can be used to find all other events generated by the same process, where it would be listed as the TargetProcessIddecimal in that process's own creation event (ProcessRollup2).

A. This is imprecise. The ContextProcessIddecimal is the process ID, which can be correlated with the TargetProcessIddecimal of other events, but this option misstates the relationship.

B. This field is fundamentally important for process tracking and event correlation during an investigation, not an internal or useless value.

C. The parent process ID is stored in a separate field, typically named ParentProcessIddecimal.

1. CrowdStrike Falcon® Platform Documentation, "Event Data Dictionary". The dictionary defines ContextProcessIddecimal as the process identifier for the process that is the context of the event, confirming its role in identifying the event's source process.