CCFR-201 Exam Questions and Answers

QUESTION: 6

When examining raw event data, what is the purpose of the field called ParentProcessld_decimal?

It contains an internal value not useful for an investigation
It contains the TargetProcessld_decimal value of the child process
It contains the Sensorld_decimal value for related events
It contains the TargetProcessld_decimal of the parent process

Answer(s): D

Explanation:

According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the ParentProcessld_decimal field contains the decimal value of the process ID of the parent process that spawned or injected into the target process. This field can be used to trace the process lineage and identify malicious or suspicious activities.

Reveal Solution Next Question

QUESTION: 7

What action is used when you want to save a prevention hash for later use?

Always Block
Never Block
Always Allow
No Action

Answer(s): A

Explanation:

According to the CrowdStrike Falcon® Data Replicator (FDR) Add-on for Splunk Guide, the Always Block action allows you to block a file from executing on any host in your organization based on its hash value. This action can be used to prevent known malicious files from running on your endpoints.

Reveal Solution Next Question

QUESTION: 8

A list of managed and unmanaged neighbors for an endpoint can be found:

by using Hosts page in the Investigate tool
by reviewing "Groups" in Host Management under the Hosts page
under "Audit" by running Sensor Visibility Exclusions Audit
only by searching event data using Event Search

Answer(s): A

Explanation:

According to the CrowdStrike Falcon® Data Replicator (FDR) Add-on for Splunk Guide, you can use the Hosts page in the Investigate tool to view information about your endpoints, such as hostname, IP address, OS, sensor version, etc. You can also see a list of managed and unmanaged neighbors for each endpoint, which are other devices that have communicated with that endpoint over the network. This can help you identify potential threats or vulnerabilities in your network.

Reveal Solution Next Question

QUESTION: 9

What happens when a hash is allowlisted?

Execution is prevented, but detection alerts are suppressed
Execution is allowed on all hosts, including all other Falcon customers
The hash is submitted for approval to be allowed to execute once confirmed by Falcon specialists
Execution is allowed on all hosts that fall under the organization's CID

Answer(s): D

Explanation:

According to the CrowdStrike Falcon® Data Replicator (FDR) Add-on for Splunk Guide, the allowlist feature allows you to exclude files or directories from being scanned or blocked by CrowdStrike's machine learning engine or indicators of attack (IOAs)2. This can reduce false positives and improve performance.
When you allowlist a hash, you are allowing that file to execute on any host that belongs to your organization's CID (customer ID)2. This does not affect other Falcon customers or hosts outside your CID2.

Reveal Solution Next Question

QUESTION: 10

Which of the following is returned from the IP Search tool?

IP Summary information from Falcon events containing the given IP
Threat Graph Data for the given IP from Falcon sensors
Unmanaged host data from system ARP tables for the given IP D. IP Detection Summary information for detection events containing the given IP

Answer(s): A

Explanation:

According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the IP Search tool allows you to search for an IP address and view a summary of information from Falcon events that contain that IP address. The summary includes the hostname, sensor ID, OS, country, city, ISP, ASN, and geolocation of the host that communicated with that IP address.

Reveal Solution Next Question

CrowdStrike CCFR-201 Exam (page: 2) CrowdStrike Certified Falcon Responder Updated on: 25-Dec-2025

QUESTION: 6

Explanation:

QUESTION: 7

Explanation:

QUESTION: 8

Explanation:

QUESTION: 9

Explanation:

QUESTION: 10

Explanation:

CrowdStrike CCFR-201 Exam (page: 2)
CrowdStrike Certified Falcon Responder
Updated on: 25-Dec-2025