OpenExamsFREE PRACTICE — ANY EXAM

CrowdStrike Certified Falcon Responder (CCFR) — Information & Free Practice

100 free questions · Answer explanations · No signup required

Start free practice →

Exam Review

About CrowdStrike Certified Falcon Responder (CCFR)

CrowdStrike Certified Falcon Responder (CCFR) · US

Key exam facts

Provider
Pearson
Format
Proctored multiple-choice, single-correct response; Pearson test center or Pearson OnVUE.
Exam questions
Total questions: 60.
Time limit
90 minutes
Exam fee
Exam vouchers: $250 USD; included for designated Flex for Services: Subscription named users; direct Pearson credit-card payment may incur additional taxes and fees.

Topics covered

  • MITRE ATT&CK Framework Application

    • Understand what information the MITRE ATT&CK framework provides
    • Apply MITRE ATT&CK tactics and techniques within Falcon to provide context to a detection

  • Detection Analysis

    • Recommend courses of action based on the analysis of information provided with Falcon
    • Interpret information displayed in the Endpoint security > Activity dashboard
    • Interpret information displayed in Endpoint security > Endpoint detections
    • Determine appropriate response to an activity based on detection source
    • Understand use cases for built-in OSINT tools
    • Explain what contextual event data is available in detection (IP/DNS/Disk/etc.)
    • Triage a detection using filtering, grouping and sort-by
    • Evaluate the impact of internal and external prevalence
    • Evaluate an activity and determine a response based on information displayed in the Full Detection view
    • Interpret the data provided in the View As Process Tree, View As Process Table and View As Process Activity
    • Identify managed/unmanaged Neighbors for an endpoint during a Host Search
    • Understand an IOC and the different types of actions available via Falcon
    • Distinguish the use cases for various Hash Management Actions (Block, Block and Hide Detection, Detect Only, Allow, No action)
    • Understand the effects of allowlisting and blocklisting
    • Explain the effects of machine learning exclusion rules, sensor visibility exclusions, and IOA exclusions
    • Apply best practices to quarantined files

  • Event Search

    • Perform an Advanced Event Search from a detection and refine a search using event actions
    • Determine when and why to use specific event actions
    • Distinguish between commonly used event types

  • Event Investigation

    • Explain what information a Process Timeline will provide
    • Explain what information a Host Timeline will provide
    • Understand when to pivot to a Process Timeline or Process Explorer from an Event Search
    • Analyze process relationships (parent/child/sibling) using the information contained in the Full Detection Details

  • Search Tools

    • Analyze the information provided in a User Search
    • Analyze the information provided in an IP Search
    • Analyze the information provided in a Hash Search
    • Analyze the information provided in Host Search results
    • Analyze the information provided in a Bulk Domain Search

  • Falcon Real Time Response (RTR)

    • Explain the technical capabilities of Falcon Real Time Response
    • Identify administrative requirements for Real Time Response settings
    • Determine when and how to connect to a host
    • Investigate a threat within Falcon and use RTR commands to remediate it
    • Utilize custom scripts in RTR to remediate a threat
    • Set up a Workflow with RTR custom scripts
    • Review audit logs to audit RTR activity

How to prepare

Work through the topics, read the explanation after each answer, and revisit the areas where you miss questions. Use the official outline and reference materials below to guide your study.

These independent practice questions are not actual exam items and do not guarantee a passing result.

Frequently asked questions

What is the exam format?

Proctored multiple-choice, single-correct response; Pearson test center or Pearson OnVUE.

How many questions are on the exam?

Total questions: 60.

How long is the exam?

90 minutes

How much does the exam cost?

Exam vouchers: $250 USD; included for designated Flex for Services: Subscription named users; direct Pearson credit-card payment may incur additional taxes and fees.

Official sources and references

Confirm current exam arrangements with the exam provider.