Free CrowdStrike Certified Falcon Responder (CCFR) Practice Questions

Sample Practice Questions

Try these 10 sample questions from the CrowdStrike Certified Falcon Responder (CCFR) practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1In MITRE ATT&CK, what does a tactic describe?

   1. A.The adversary's goal for an actionCorrect answer: A
   2. B.The specific implementation of an action
   3. C.The lower-level variant of a technique
   4. D.The way an adversary achieves a goal

   Explanation: “It is the adversary’s tactical goal: the reason for performing an action.” This distinguishes the requested ATT&CK concept.

   Reference: MITRE ATT&CK Frequently Asked Questions — General, What are tactics?

2. 2An interactive adversary is active on a Falcon host and may have multiple running processes. Which response limits the host's immediate network spread while investigation continues?

   1. A.Network-contain the affected hostCorrect answer: A
   2. B.Keep the host connected and monitor its activity
   3. C.Allowlist the executable and continue observing
   4. D.Terminate one observed process but leave the host connected

   Explanation: “Our analysts have the capability to network-contain a host to prevent the lateral spread of the adversary within the environment.” Containment addresses the stated immediate objective while the other actions do not limit the compromised host's spread.

   Reference: Falcon Complete Disrupts WIZARD SPIDER eCrime Operators — Containment and Investigation

3. 3Which Falcon event type should an analyst use to search for DNS requests to a set of domains?

   1. A.ProcessRollup2
   2. B.NetworkConnect
   3. C.DnsRequestCorrect answer: C
   4. D.UserLogon

   Explanation: The CrowdStrike Event Search example begins “event_simpleName=DnsRequest DomainName IN” followed by domain names. DnsRequest records address the DNS question; the other event types concern different activity.

   Reference: CrowdStrike Detects and Prevents Active Intrusion Campaign Targeting 3CXDesktopApp Customers — Event Search — Domain Search

4. 4An analyst wants a timeline scoped to a particular process, to examine that process's events and detections. Which Falcon view is designed for that investigation?

   1. A.Process TimelineCorrect answer: A
   2. B.Host Timeline
   3. C.User Search
   4. D.Activity Dashboard

   Explanation: “Analyze the information displayed in the Process Timeline to understand the flow of events and detections” Process Timeline presents the flow the analyst needs to inspect.

   Reference: CrowdStrike Certified Falcon Hunter Certification Exam Guide — Exam Objectives, Detection Analysis 2.2

5. 5User Search shows systems where a compromised account was used to log in. What does that result establish by itself?

   1. A.The account was observed logging in to those systemsCorrect answer: A
   2. B.Every login by the account was malicious
   3. C.All processes on those systems ran as that account
   4. D.The account has administrator rights on every system

   Explanation: “Armed with the origin system, it was possible to use Host Search in the Investigate app to identify the most recently logged-on user, which allowed a further pivot to User Search to identify where the compromised account had been used to log in to other systems via legitimate Windows means.” The user-focused search can help trace the account across systems.

   Reference: Response When Minutes Matter: Rising Up Against Ransomware — Finding Patient Zero

6. 6What does Falcon Real Time Response enable an incident responder to do during an investigation?

   1. A.Run investigation commands on systemsCorrect answer: A
   2. B.View detections without running commands
   3. C.Run remediation commands but not collect data
   4. D.Issue commands only after host containment

   Explanation: “Real Time Response offers customers a set of built-in commands to execute against systems during a security investigation.” RTR supports direct investigation of systems through built-in commands.

   Reference: How Real Time Response Empowers Incident Response — Real Time Response commands

7. 7How does an ATT&CK technique relate to an adversary's tactical objective?

   1. A.The tactical goal behind an action
   2. B.The action used to achieve a goalCorrect answer: B
   3. C.A lower-level variation of a technique
   4. D.An observed implementation of a technique

   Explanation: “an adversary achieves a tactical goal by performing an action.” A technique describes how an adversary acts to achieve the goal.

   Reference: MITRE ATT&CK Frequently Asked Questions — General, What are techniques?

8. 8After containing a compromised host, which investigation best establishes the extent of an intrusion across the environment?

   1. A.Review host indicators while excluding the related network indicators
   2. B.Investigate affected systems and accounts, plus host and network indicatorsCorrect answer: B
   3. C.Investigate affected accounts while excluding related affected systems
   4. D.Review network indicators while excluding potentially affected accounts

   Explanation: “The next objective of the investigation was to properly scope the intrusion by identifying the affected systems/user accounts and host/network indicators of compromise.” Those related systems, accounts and indicators help establish the intrusion's scope.

   Reference: Falcon Complete Disrupts WIZARD SPIDER eCrime Operators — Containment and Investigation

9. 9Which Falcon event type is used for process execution activity in Event Search?

   1. A.DnsRequest
   2. B.UserLogon
   3. C.ProcessRollup2Correct answer: C
   4. D.NewExecutableWritten

   Explanation: CrowdStrike's example maps “ProcessRollup2” to “Process Execution”. The other event types concern DNS requests, logons or file writes.

   Reference: How CrowdStrike Protects Customers from Log4Shell Threats — Event Search query, falconEvents mapping

10. 10A Host Timeline-backed login-history query reports recent interactive sessions for a device. What can the analyst conclude from that query alone?

    1. A.It provides recent interactive login session detailsCorrect answer: A
    2. B.It proves all noninteractive sessions were successful
    3. C.It proves no other accounts have ever logged in
    4. D.It confirms every listed login was authorized

    Explanation: “Retrieve details about recent interactive login sessions for a set of devices powered by the Host Timeline.” This is a recent interactive-session view; it does not establish all historical or noninteractive logins or their authorization.

    Reference: Hosts — CrowdStrike Developer Center — QueryDeviceLoginHistoryV2