An analyst is investigating a Falcon detection on a file server. The detection shows that a process (powershell.exe) is running a script that is using the .NET WebClient class to download a file from a remote server and save it to a local share. The detection is mapped to T1105 (Ingress Tool Transfer). The analyst needs to determine the MOST likely impact of this technique on the file server. Which additional ATT&CK context is MOST relevant?

The parent process of powershell.exe.

The specific file that was downloaded and its destination path.

The tactic associated with the technique (e.g., Command and Control, Lateral Movement).

The user account under which powershell.exe is running.

What is the primary purpose of the MITRE ATT&CK framework?

To provide a standardized set of tactics and techniques used to describe adversary behavior

To define a set of compliance requirements for securing cloud infrastructure

To replace the need for endpoint detection and response tools

To provide a scoring system for ranking the severity of vulnerabilities

CrowdStrikeCertified Falcon Responder (CCFR)

Domain 1Objective 2

Apply MITRE ATT&CK Tactics and Techniques Within Falcon to Provide Context to a Detection CCFR Practice Questions (Page 4)

Part of the ATT&CK Frameworks domain, which makes up ~10% of our current practice bank.

23questions here

5free pages

5concepts

Questions 16–20

16expert · hard
An analyst is investigating a Falcon detection on a file server. The detection shows that a process (powershell.exe) is running a script that is using the .NET WebClient class to download a file from a remote server and save it to a local share. The detection is mapped to T1105 (Ingress Tool Transfer). The analyst needs to determine the MOST likely impact of this technique on the file server. Which additional ATT&CK context is MOST relevant?
Select an answer first
17foundation · easy
A Falcon detection indicates that a process is sending large volumes of data to an external IP address. Which ATT&CK tactic is most directly indicated?
Select an answer first
18foundation · easy
What is the primary purpose of the MITRE ATT&CK framework?
Select an answer first
19foundation · easy
A Falcon detection shows that a process attempted to disable a security tool on an endpoint. Which MITRE ATT&CK tactic best describes the adversary's goal?
Select an answer first
20foundation · easy
A Falcon detection shows a process using PowerShell to download and execute a payload from a remote server. Which ATT&CK technique is most directly indicated?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFR” is a trademark of its owner, used for identification only.

Apply MITRE ATT&CK Tactics and Techniques Within Falcon to Provide Context to a Detection CCFR Practice Questions (Page 4)

Questions 16–20

A Falcon detection indicates that a process is sending large volumes of data to an external IP address. Which ATT&CK tactic is most directly indicated?

What is the primary purpose of the MITRE ATT&CK framework?

A Falcon detection shows that a process attempted to disable a security tool on an endpoint. Which MITRE ATT&CK tactic best describes the adversary's goal?

A Falcon detection shows a process using PowerShell to download and execute a payload from a remote server. Which ATT&CK technique is most directly indicated?

Keep studying — ATT&CK Frameworks