Free CrowdStrike CCFR-201b Exam Questions

Become CrowdStrike Certified with updated CCFR-201b exam questions and correct answers

Page: 1 / 12

Total 60 Questions | Updated On: Mar 06, 2026

Add To Cart

Question 1

The Falcon platform will show a maximum of how many detections per day for a single Agent Identifier (AID)?

A : 500

B : 750

C : 1000

D : 1200

Answer: C

Question 2

You can jump to a Process Timeline from many views, like a Hash Search, by clicking which of the following?

A : ProcessTimeline Link

B : PID

C : UTC time

D : Process ID or Parent Process ID

Answer: B

Question 3

You notice that taskeng.exe is one of the processes involved in a detection. What activity should you investigate next?

A : User logons after the detection

B : Executions of schtasks.exe after the detection

C : Scheduled tasks registered prior to the detection

D : Pivot to a Hash search for taskeng.exe

Answer: C

Question 4

A list of managed and unmanaged neighbors for an endpoint can be found:

A : by using Hosts page in the Investigate tool

B : by reviewing "Groups" in Host Management under the Hosts page

C : under "Audit" by running Sensor Visibility Exclusions Audit

D : only by searching event data using Event Search

Answer: A

Question 5

Where can you find hosts that are in Reduced Functionality Mode?

A : Event Search

B : Executive Summary dashboard

C : Host Search

D : Installation Tokens

Answer: C

Page: 1 / 12

Total 60 Questions | Updated On: Mar 06, 2026

Add To Cart