CCFR-201 Practice Test

Review 60 CCFR-201 practice questions with answer explanations and community insights.

Question 1

Where can you find hosts that are in Reduced Functionality Mode?

  1. Event Search
  2. Executive Summary dashboard
  3. Host Search
  4. Installation Tokens

Question 2

When reviewing a Host Timeline, which of the following filters is available?

  1. Severity
  2. Event Types
  3. User Name
  4. Detection ID

Question 3

How does a DNSRequest event link to its responsible process?

  1. Via both its ContextProcessId_decimal and ParentProcessId_decimal fields
  2. Via its ParentProcessId_decimal field
  3. Via its ContextProcessId_decimal field
  4. Via its TargetProcessId_decimal field

Question 4

What information does the MITRE ATT&CK Framework provide?

  1. It provides best practices for different cybersecurity domains, such as Identify and Access Management
  2. It provides a step-by-step cyber incident response strategy
  3. It provides the phases of an adversary's lifecycle, the platforms they are known to attack, and the specific methods they use
  4. It is a system that attributes attack techniques to a specific threat actor

Question 5

Within the MITRE-Based Falcon Detections Framework, what is the correct way to interpret Keep Access > Persistence > Create Account?

  1. An adversary is trying to keep access through persistence by creating an account
  2. An adversary is trying to keep access through persistence using browser extensions
  3. An adversary is trying to keep access through persistence using external remote services
  4. An adversary is trying to keep access through persistence using application skimming