CrowdStrike Certified Falcon Responder - CCFR-201b Exam Questions [2026]

QUESTION NO: 1
During the configuration of a new IOA rule, the administrator must decide what action the sensor should take.
Which of the following is NOT a valid IOA rule action?

A. Kill Process B. Block C. Monitor D. No Action

Correct Answer: D

QUESTION NO: 2
What happens when you open the full detection details?

A. Theprocess explorer opens and the detection is removed from the console B. The process explorer opens and you ' re able to view the processes and process relationships C. The process explorer opens and the detection copies to the clipboard D. The process explorer opens and the Event Search query is run for the detection

Correct Answer: B

QUESTION NO: 3
Which Executive Summary dashboard item indicates sensors running with unsupported versions?

A. Active Sensors B. Sensors in RFM C. Detections by Severity D. Inactive Sensors

Correct Answer: B

QUESTION NO: 4
Where can you find hosts that are in Reduced Functionality Mode?

A. Executive Summary dashboard B. Host Search C. Installation Tokens D. Event Search

Correct Answer: A

QUESTION NO: 5
To manage the lifecycle of security incidents and review new alerts, a responder must navigate through the Falcon sidebar to which specific location?

A. Endpoint Security > Monitor > Endpoint Detections B. Dashboards > Global Activity > Security Alerts C. Configuration > Security Policies > Detections D. Investigate > Host Search > Alerts

Correct Answer: A

QUESTION NO: 6
Depending on the subscription level, " Cloudable Events " (standard telemetry) have a specific retention period. What is the minimum period of time that these events are retained?

A. 1 day B. 14 days C. 30 days D. 7 days

Correct Answer: D

QUESTION NO: 7
You are reviewing the raw data in an Event Search from a detection tree. You find a DnsRequest event and want to determine whether any other DNS requests were performed by the original process.
Which two field values do you need from this event to perform a Process Timeline search?

A. RequestType and aid B. ResponsibleProcessId and aid C. ContextProcessId and aid D. ParentProcessId and aid

Correct Answer: C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 8
A responder releases a file from quarantine on a specific workstation. What is the default scope of the allowlist that is created during this process?

A. All hosts within the same host group as the source host B. Only the specific host where the file was originally quarantined C. All hosts running the same operating system version D. Global (applies to all hosts in the environment)

Correct Answer: B

QUESTION NO: 9
When analyzing the raw telemetry for a ' DNSRequest ' event, which of the following raw data fields is available to the responder?

A. monitor_mode B. browser_type C. cpu_usage_percent D. index

Correct Answer: D

QUESTION NO: 10
A responder needs to categorize an incident based on the high-level goals of the attacker. Which of the following lists correctly identifies the " Objectives " as they are natively defined and used within the Falcon platform?

A. Reconnaissance, Delivery, Weaponization, Exploitation, Installation, Command and Control B. Triage, Containment, Remediation, Eradication, Reporting, Recovery C. Explore, Keep Access, Gain Access, Falcon Detection Method, Contact Controlled systems, Follow Through D. Identify, Protect, Detect, Respond, Recover, Lessons Learned

Correct Answer: C

QUESTION NO: 11
While reviewing the ' Detection Method ' field for a high-severity alert, a responder sees the label ' Post- Exploit ' . This terminology is used by CrowdStrike to identify a specific:

A. MITRE Tactic B. Prevention Policy Level C. Indicator of Attack (IOA) D. Falcon Detection Method

Correct Answer: D

QUESTION NO: 12
Host Search is a powerful investigation tool. From which of the following sources is a responder most likely to pivot directly to a Host Search?

A. A specific detection that occurred on a particular host. B. The help documentation in the Support portal. C. The main settings menu of the Falcon console. D. A global intelligence report about a new adversary.

Correct Answer: A