CrowdStrikeCertified Falcon Responder (CCFR)
Domain 3Objective 2
Determine When and Why to Use Specific Event Actions CCFR Practice Questions (Page 2)
Part of the Event Search domain, which makes up ~9% of our current practice bank.
9questions here
2free pages
3concepts
Questions 6–9
- 6
An analyst wants to categorize a set of events as 'malicious' for future filtering and reporting. Which event action is most appropriate?
Select an answer first - 7
In Falcon Event Search, after selecting an event from the results, where does an analyst typically find the available event actions?
Select an answer first - 8
A Falcon analyst is investigating a malware infection that is spreading through a network share. The analyst wants to stop the spread by preventing the malware from executing on any endpoint, but the analyst does not want to disrupt the network share itself. Which event action should the analyst take?
Select an answer first - 9
Which Falcon Event Search action is used to change the status of an event to indicate that it has been examined and no further action is needed?
Select an answer first
Finished these 4 questions?
Review the revealed explanations, or continue through the curriculum.
No more pagesBack to CCFR
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFR” is a trademark of its owner, used for identification only.