CrowdStrikeCertified Falcon Responder (CCFR)
Domain 3Objective 2
Determine When and Why to Use Specific Event Actions CCFR Practice Questions (Page 1)
Part of the Event Search domain, which makes up ~9% of our current practice bank.
9questions here
2free pages
3concepts
Questions 1–5
- 1
A Falcon analyst is investigating a data breach that involved a compromised user account. The analyst has identified the account and wants to prevent further misuse, but the account is used by a remote employee who is currently working. The analyst also needs to maintain the ability to monitor the account's activity for any further suspicious behavior. Which event action should the analyst take?
Select an answer first - 2
In Falcon Event Search, which event action allows an analyst to add a comment to a specific event for collaboration and documentation purposes?
Select an answer first - 3
During an investigation, an analyst needs to preserve the raw event data for offline analysis and evidence retention. Which event action should they use?
Select an answer first - 4
A Falcon analyst is investigating a data breach that involved a compromised service account. The analyst has identified the account and wants to prevent further misuse, but the account is used by a critical application that cannot be stopped. The analyst also needs to maintain the ability to monitor the account's activity for any further suspicious behavior. Which event action should the analyst take?
Select an answer first - 5
When applying the 'Add Comment' action to an event in Falcon Event Search, what is the immediate result?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFR” is a trademark of its owner, used for identification only.