CrowdStrike CCFR: CrowdStrike Certified Falcon Responder (CCFR)

Last checked November 10, 2026 against the official CrowdStrike exam page.

1. Question 1ATT&CK Framework Application

   A SOC lead asks an analyst to explain MITRE ATT&CK to a new team member who has only worked with signature-based tools. Which description is most accurate?

   1. AA certification program that audits endpoint products for regulatory compliance
   2. BA publicly maintained knowledge base of adversary behaviors, organized into tactics and techniques
   3. CA database of known malicious file hashes that endpoint products use for blocking
   4. DA scoring system that ranks software vulnerabilities by their potential business impact
   Show answer and explanationHide answer

   Correct answer: B

   ATT&CK is a freely available knowledge base that describes observed adversary behavior, organized by tactics (goals) and techniques (methods). The other options describe a certification program, a hash database and a vulnerability scoring system, none of which ATT&CK is.

2. Question 2Detection Analysis

   An analyst has 40 open detections spread across a busy workstation fleet. Which triage approach makes the best use of the console's filtering, grouping and sorting?

   1. AWork the queue in creation order and ignore severity so that older alerts receive equal attention
   2. BClose every detection on hosts that have more than five alerts to reduce the open count quickly
   3. CFilter to open items, sort by severity, then group related detections by host to reveal patterns
   4. DPause triage until the queue drops below ten items so the analyst can give each one full focus
   Show answer and explanationHide answer

   Correct answer: C

   Filtering to open items and sorting by severity puts the riskiest work first, and grouping by host reveals related activity across detections. Creation-order triage ignores risk, while closing alerts unreviewed or pausing triage leaves real threats uninvestigated.

3. Question 3Event Search

   An analyst is reviewing a detection on a finance server and wants the raw events tied to that process, with the host and time window already filled in. Which starting point is best?

   1. AAdvanced Event Search launched from the detection, which carries over its context
   2. BBulk Domain Search, which checks a list of domains against all endpoint activity
   3. CHost Search, which lists installed software and last-seen dates for the server
   4. DA Real Time Response session, which runs commands directly on the server
   Show answer and explanationHide answer

   Correct answer: A

   Launching Advanced Event Search from a detection carries over its host and process context, so the analyst does not rebuild filters by hand. The other tools answer different questions, such as software inventory, domain matching or live command execution.

4. Question 4Event Investigation

   An analyst wants to follow everything one suspicious process did after it launched, including child activity, network connections and file writes, in time order. Which view fits best?

   1. AHost Timeline, which shows every event on the endpoint in chronological order
   2. BHash Search, which lists every endpoint where the process's file has been seen
   3. CProcess Timeline, which shows one process's activity in chronological order
   4. DUser Search, which lists the logons associated with the account that ran the process
   Show answer and explanationHide answer

   Correct answer: C

   Process Timeline is scoped to one process and orders its activity over time. The host timeline covers the whole machine, which is too broad for this question, while hash and user searches answer different questions about where a file or account appears.

5. Question 5Search Tools

   An analyst suspects that a remote IP address is being used for command-and-control traffic and needs to know which hosts communicated with it. Which search fits?

   1. AIP Search, which finds the hosts that communicated with the address
   2. BHost Search, which finds a host by its name, identifier or operating system
   3. CUser Search, which lists the logons and activity tied to a single account
   4. DHash Search, which finds the endpoints where a particular file has been observed
   Show answer and explanationHide answer

   Correct answer: A

   IP Search starts from a network address and returns the hosts that communicated with it, which answers the question directly. Host, user and hash searches start from different artifacts and cannot show which endpoints connected to that address.