Free CrowdStrike CCFR-201b Exam Questions

Become CrowdStrike Certified with updated CCFR-201b exam questions and correct answers

Page: 1 / 12

Total 60 Questions | Updated On: Dec 18, 2025

Add To Cart

Question 1

Which Executive Summary dashboard item indicates sensors running with unsupported versions?

A : Detections by Severity

B : Inactive Sensors

C : Sensors in RFM

D : Active Sensors

Answer: C

Question 2

What happens when you open the full detection details?

A : The process explorer opens and the detection is removed from the console

B : The process explorer opens and you’re able to view the processes and process relationships

C : The process explorer opens and the detection copies to the clipboard

D : The process explorer opens and the Event Search query is run for the detection

Answer: B

Question 3

The Falcon platform will show a maximum of how many detections per day for a single Agent Identifier (AID)?

A : 500

B : 750

C : 1000

D : 1200

Answer: C

Question 4

From the Detections page, how can you view 'in-progress' detections assigned to Falcon Analyst Alex?

A : Filter on 'Analyst: Alex'

B : Alex does not have the correct role permissions as a Falcon Analyst to be assigned detections

C : Filter on 'Hostname: Alex' and 'Status: In-Progress'

D : Filter on 'Status: In-Progress' and 'Assigned-to: Alex

Answer: D

Question 5

You notice that taskeng.exe is one of the processes involved in a detection. What activity should you investigate next?

A : User logons after the detection

B : Executions of schtasks.exe after the detection

C : Scheduled tasks registered prior to the detection

D : Pivot to a Hash search for taskeng.exe

Answer: C

Page: 1 / 12

Total 60 Questions | Updated On: Dec 18, 2025

Add To Cart