A Falcon analyst opens a detection triggered by a suspicious PowerShell command on a finance workstation. The Process Tree view shows powershell.exe spawned by winword.exe, which was launched from an email attachment. The PowerShell process then spawned cmd.exe, which executed a script that made an outbound connection to an IP address not seen before in the environment. Which conclusion is best supported by this process tree?

The attack chain began with the email attachment and progressed through multiple stages to establish the outbound connection.

The PowerShell process was compromised by a separate, unrelated intrusion that happened to occur at the same time.

The outbound connection is the root cause of the detection, and the document was merely a decoy to distract the analyst.

The cmd.exe process is the initial infection vector because it executed the script that made the network connection.

In the Endpoint security > Activity dashboard, which metric is used to identify a sudden spike in endpoint activity that may indicate an anomaly?

Total number of active endpoints

An analyst is following the Falcon detection analysis workflow for a new detection. The analyst has already reviewed the detection details, examined the process tree, and identified the malicious activity. According to the workflow, what is the next step the analyst should take?

Recommend an appropriate course of action based on the analysis.

Immediately contain the host without further analysis.

Close the detection as a false positive without documenting the findings.

Re-run the detection to see if it triggers again.

A Falcon Responder wants to focus on the most critical detections first. Which triage technique is most appropriate?

Sort by host name alphabetically

Filter by severity and sort by severity descending

Filter by detection status 'closed'

In the Endpoint security > Endpoint detections list, what does the 'Status' column typically show?

The current workflow state of the detection (e.g., new, in progress, closed)

The operating system of the affected host

The IP address of the affected host

CrowdStrikeCertified Falcon Responder (CCFR)

Domain 2Objective 1

Analyze Detection Information CCFR Practice Questions (Page 5)

Part of the Detection Analysis domain, which makes up ~14% of our current practice bank.

33questions here

7free pages

9concepts

Questions 21–25

21application · medium
A Falcon analyst opens a detection triggered by a suspicious PowerShell command on a finance workstation. The Process Tree view shows powershell.exe spawned by winword.exe, which was launched from an email attachment. The PowerShell process then spawned cmd.exe, which executed a script that made an outbound connection to an IP address not seen before in the environment. Which conclusion is best supported by this process tree?
Select an answer first
22foundation · easy
In the Endpoint security > Activity dashboard, which metric is used to identify a sudden spike in endpoint activity that may indicate an anomaly?
Select an answer first
23application · medium
An analyst is following the Falcon detection analysis workflow for a new detection. The analyst has already reviewed the detection details, examined the process tree, and identified the malicious activity. According to the workflow, what is the next step the analyst should take?
Select an answer first
24foundation · easy
A Falcon Responder wants to focus on the most critical detections first. Which triage technique is most appropriate?
Select an answer first
25foundation · easy
In the Endpoint security > Endpoint detections list, what does the 'Status' column typically show?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFR” is a trademark of its owner, used for identification only.