CrowdStrike Exam CCFR-201 Topic 2 Question 31 Discussion

Actual exam question for CrowdStrike's CCFR-201 exam

Question #: 31
Topic #: 2

What does pivoting to an Event Search from a detection do?

AIt gives you the ability to search for similar events on other endpoints quickly

BIt takes you to the raw Insight event data and provides you with a number of Event Actions

CIt takes you to a Process Timeline for that detection so you can see all related events

DIt allows you to input an event type, such as DNS Request or ASEP write, and search for those events within the detection

Show Suggested Answer

Suggested Answer: B

According to theCrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, Global Prevalence and Local Prevalence are two fields that provide information about how common or rare a file is based on its hash value2.Global Prevalence tells you how frequently the hash of the triggering file is seen across all CrowdStrike customer environments2.Local Prevalence tells you how frequently the hash of the triggering file is seen within your environment (CID)2.These fields can help you assess the risk and impact of a detection2.

by Merilyn at Jan 10, 2025, 12:00 AM

Limited Time Offer

25%

Off

Get Premium CCFR-201 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Caprice

2 days ago

I see both points. But I think it's important to have a Process Timeline for that detection so you can see all related events. So, I would choose option C as the best choice.

upvoted 0 times

...

Major

2 days ago

I disagree with Elena. I believe that it takes you to the raw Insight event data and provides you with a number of Event Actions. Option B seems more logical to me.

upvoted 0 times

...

Elena

4 days ago

I think pivoting to an Event Search from a detection allows you to search for similar events on other endpoints quickly. So, I would go with option A.

upvoted 0 times

...