CrowdStrike Certified Falcon Responder - CCFR-201b Exam Questions [2026]

QUESTION NO: 1
Data retention is a key factor in retrospective hunting. How long will " Detection Related Events " be retained in the Falcon environment?

A. 1 year B. 30 days C. 90 days D. 60 days

Correct Answer: C

QUESTION NO: 2
You are pre-staging a Custom IOC for later use and want to save a file hash for later use after approval.
Which action should you use?

A. Always Block B. Monitor C. Save Hash D. No Action

Correct Answer: D

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 3
What action is needed to ensure Falcon does not block or generate a detection for a process by using the file hash?

A. Create a Machine Learning Exclusion with an action of allow for the hash B. Create a Custom IOC with an action of allow for the hash C. Create an IOA Exclusion with an action of allow for the hash D. Create a Custom IOA with an action of allow for the hash

Correct Answer: B

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 4
A responder decides to set a specific Custom IOA to the ' Monitor ' action. Which of the following sentences best describes the technical result of this choice?

A. The sensor will log the activity in the audit logs but will not generate a detection. B. The sensor will automatically isolate the host from the network. C. The sensor will create detections with ' Informational ' severity but will not block the activity. D. The sensor will block the activity and alert the user with a pop-up.

Correct Answer: C

QUESTION NO: 5
A responder is unsure about the difference between ' Detection ' and ' Prevention ' settings. Where can they find information about Detection and Prevention Policies?

A. In the Support page under the Docs section. B. By clicking the ' About ' button in the user profile. C. In the training videos on the main Dashboard. D. On the public CrowdStrike blog.

Correct Answer: A

QUESTION NO: 6
When managing files within the ' Quarantined Files ' dashboard, which of the following is NOT a valid action available to the responder?

A. Download B. Investigate C. Release D. Delete

Correct Answer: B

QUESTION NO: 7
After pivoting to an event search from a detection, you locate the ProcessRollup2 event. Which two field values are you required to obtain to perform a Process Timeline search so you can determine what the process was doing?

A. SHA256 and ParentProcessld_decimal B. aid and TargetProcessld_decimal C. SHA256 and TargetProcessld_decimal D. aid and ParentProcessld_decimal

Correct Answer: B

QUESTION NO: 8
If a file has a prevalence of ' Local: Low ' and ' Global: High ' , what does this typically indicate to a responder?

A. The file is a targeted piece of malware specifically designed for the company. B. The file is a custom script written by a local administrator. C. The file is common off-the-shelf software or malware seen across many environments. D. The file is a unique configuration file for a proprietary application.

Correct Answer: C

QUESTION NO: 9
To manage the lifecycle of security incidents and review new alerts, a responder must navigate through the Falcon sidebar to which specific location?

A. Endpoint Security > Monitor > Endpoint Detections B. Dashboards > Global Activity > Security Alerts C. Configuration > Security Policies > Detections D. Investigate > Host Search > Alerts

Correct Answer: A

QUESTION NO: 10
You are writing a script that your colleagues could run on any Windows machine using Real Time Response (RTR). The script you have written is over the 40-KB limit.
How should you run the script to avoid technical issues?

A. Use the runscript -cloudfile command to upload the script from your local machine and execute it directly B. Use the put command to place the script on the host and runscript -hostpath to run the script C. Break the script into multiple files under 40 KB and run each one sequentially with runscript -raw D. Use the put command to place the script on the host and runscript -cloudfile to run the script

Correct Answer: B

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 11
Where are quarantine files located on a Mac Endpoint?

A. /Library/CS/Quarantine B. /Users/Shared/CS/Quarantine C. /Applications/Falcon/Quarantine D. /tmp/cs/quarantine

Correct Answer: A