CertArea
All CrowdStrike exams

Free CCFR practice test: 30 questions with answers

30 original questions for CrowdStrike Certified Falcon Responder (CCFR), drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
112 questions
Real exam
60 questions, 90 min

CCFR exam guide: topics, cost and format

All 30 CCFR questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

ATT&CK Framework Application (5 questions)

  1. Question 1

    A SOC lead asks an analyst to explain MITRE ATT&CK to a new team member who has only worked with signature-based tools. Which description is most accurate?

    1. AA certification program that audits endpoint products for regulatory compliance
    2. BA publicly maintained knowledge base of adversary behaviors, organized into tactics and techniques
    3. CA database of known malicious file hashes that endpoint products use for blocking
    4. DA scoring system that ranks software vulnerabilities by their potential business impact
    Show answer and explanation
    Correct answer: B

    ATT&CK is a freely available knowledge base that describes observed adversary behavior, organized by tactics (goals) and techniques (methods). The other options describe a certification program, a hash database and a vulnerability scoring system, none of which ATT&CK is.

  2. Question 2

    During a detection review, an analyst wants to describe the adversary's objective at one stage of the intrusion, such as gaining a foothold or moving to other systems. Which ATT&CK element is this?

    1. ATechnique, the specific method the adversary uses to reach that objective
    2. BMitigation, the defensive measure recommended against the observed behavior
    3. CData source, the telemetry where the behavior can be observed on endpoints
    4. DTactic, the adversary's tactical goal at a given stage of an operation
    Show answer and explanation
    Correct answer: D

    Tactics are the why of an adversary action, such as Persistence or Lateral Movement. Techniques describe how a goal is achieved, mitigations describe defenses, and data sources describe where evidence can be collected.

  3. Question 3

    A detection shows powershell.exe launched with an encoded command argument. Which ATT&CK mapping best describes the interpreter activity itself?

    1. AT1059.001, PowerShell, a sub-technique of Command and Scripting Interpreter
    2. BT1566, Phishing, the technique covering how the initial lure was delivered
    3. CT1486, Data Encrypted for Impact, the technique covering ransomware encryption
    4. DT1078, Valid Accounts, the technique covering reuse of legitimate credentials
    Show answer and explanation
    Correct answer: A

    T1059.001 is the PowerShell sub-technique under Command and Scripting Interpreter, which matches abuse of a script interpreter. The other mappings describe phishing delivery, file encryption for impact and credential misuse, none of which the detection shows.

  4. Question 4

    A team wants to use ATT&CK to strengthen its detection program. Which two actions use the framework correctly? (Choose two.)

    1. AMap existing detections to technique IDs to see where detection coverage is weak
    2. BReplace prevention policies with the matrix, since it lists which files should be blocked
    3. CPrioritize new detections for techniques used by adversaries that target the organization's industry
    4. DUse tactic names as file hash signatures so each stage of an attack can be blocked directly
    Show answer and explanation
    Correct answer: A, C

    Mapping detections to techniques reveals coverage gaps, and prioritizing techniques used by adversaries who target your industry focuses effort where it matters. ATT&CK is a knowledge base rather than a list of files or prevention rules, so using it as a blocklist or policy replacement misuses it.

  5. Question 5

    An analyst reviewing a Credential Access detection wants to explain how ATT&CK entries relate to one another. Which statement is accurate?

    1. AA sub-technique is a broader goal that groups several tactics under one label
    2. BA tactic groups related techniques, and a technique can be refined into sub-techniques
    3. CA technique describes the adversary's goal, while a tactic describes a single command
    4. DTactics and techniques are two names for the same entry in the knowledge base
    Show answer and explanation
    Correct answer: B

    Tactics group techniques by goal, and techniques can be refined further into sub-techniques such as T1059.001. The other options reverse the hierarchy or treat distinct levels as synonyms.

Detection Analysis (5 questions)

  1. Question 6

    An analyst has 40 open detections spread across a busy workstation fleet. Which triage approach makes the best use of the console's filtering, grouping and sorting?

    1. AWork the queue in creation order and ignore severity so that older alerts receive equal attention
    2. BClose every detection on hosts that have more than five alerts to reduce the open count quickly
    3. CFilter to open items, sort by severity, then group related detections by host to reveal patterns
    4. DPause triage until the queue drops below ten items so the analyst can give each one full focus
    Show answer and explanation
    Correct answer: C

    Filtering to open items and sorting by severity puts the riskiest work first, and grouping by host reveals related activity across detections. Creation-order triage ignores risk, while closing alerts unreviewed or pausing triage leaves real threats uninvestigated.

  2. Question 7

    An unknown executable is detected on a single laptop. Its hash has very low prevalence across the wider CrowdStrike customer base, and no other host in the organization has it. What is the most reasonable next step?

    1. ADeclare an enterprise-wide incident, because any file with a single internal sighting must be malware
    2. BAllowlist it right away, since rare files on a single laptop are usually harmless internal tools
    3. CClose the detection, because low external prevalence means only the vendor's own software uses it
    4. DInvestigate its behavior and origin, since low prevalence warrants concern but does not prove compromise
    Show answer and explanation
    Correct answer: D

    Rare files merit investigation because they can point to targeted activity, but low prevalence alone does not prove malice. The other options draw unsupported conclusions from prevalence data, in one case assuming safety and in the others assuming guilt.

  3. Question 8

    Threat intelligence confirms that one file hash is malicious, and the file has appeared on several endpoints. The team wants protected hosts to stop running it. Which hash management action fits?

    1. AAllow, so the file is trusted and no further detections are generated on any host
    2. BDetect Only, so analysts receive an alert each time the file is seen on an endpoint
    3. CAn exclusion for the folder where the file was found, so the sensor ignores that location
    4. DBlock, so the hash is prevented from executing on protected endpoints
    Show answer and explanation
    Correct answer: D

    A Block action on a hash prevents the matching file from running on protected hosts, which is what a confirmed malicious file needs. Detect Only still allows execution while alerting, Allow trusts the file, and a folder exclusion would hide activity in that location.

  4. Question 9

    A line-of-business tool was blocked by a hash rule after a vendor update, and the business needs it running again. Which two actions follow good practice? (Choose two.)

    1. AAllowlist the exact hash of the approved new version rather than excluding the whole installation folder
    2. BRecord the business owner, the justification and a review date on the allowlist entry
    3. CCreate a broad exclusion for the entire drive so future vendor updates never need review
    4. DApprove the change without checking the new file, because the vendor is well known
    Show answer and explanation
    Correct answer: A, B

    A hash allowlist entry is narrow and tied to the approved version, and recording an owner, justification and review date keeps the exception auditable. A drive-wide exclusion and approval without checking the file both remove protection without evidence that the change is safe.

  5. Question 10

    The sensor quarantines a file that a user insists is needed for daily work. What should the analyst do before releasing the file from quarantine?

    1. ARelease it straight away, since quarantine is only a temporary label that does not isolate the file
    2. BReview the detection context and the file's reputation, and release only after confirming it is benign
    3. CDelete the file from the quarantine list and ask the user to download a fresh copy from the internet
    4. DAdd the file's folder as an exclusion first, so the file can run without triggering another quarantine
    Show answer and explanation
    Correct answer: B

    Quarantine isolates a suspicious file, so release should follow a verified review of its detection context and reputation rather than user pressure. Releasing immediately ignores why the file was isolated, and a folder exclusion would widen the blind spot.

Event Search (5 questions)

  1. Question 11

    An analyst is reviewing a detection on a finance server and wants the raw events tied to that process, with the host and time window already filled in. Which starting point is best?

    1. AAdvanced Event Search launched from the detection, which carries over its context
    2. BBulk Domain Search, which checks a list of domains against all endpoint activity
    3. CHost Search, which lists installed software and last-seen dates for the server
    4. DA Real Time Response session, which runs commands directly on the server
    Show answer and explanation
    Correct answer: A

    Launching Advanced Event Search from a detection carries over its host and process context, so the analyst does not rebuild filters by hand. The other tools answer different questions, such as software inventory, domain matching or live command execution.

  2. Question 12

    An analyst needs every DNS lookup made by a suspicious process on one host. Which Falcon event type records these lookups?

    1. ANetworkConnectIP4
    2. BProcessRollup2
    3. CDnsRequest
    4. DUserLogon
    Show answer and explanation
    Correct answer: C

    DnsRequest is the event type that records domain name lookups. ProcessRollup2 records process execution, NetworkConnectIP4 records connections to IP addresses and UserLogon records account sign-ins, so none of them capture DNS lookups.

  3. Question 13

    While reviewing results in Event Search, an analyst spots an unusual child process and wants to see its related activity without rewriting the query. What does an event action provide here?

    1. AIt permanently removes matching events from the event store so they stop appearing
    2. BIt changes the prevention policy on the host that produced the event to block activity
    3. CIt pivots from the selected event to related activity without rebuilding the query
    4. DIt resets the host timeline so the investigation starts from the first event of the day
    Show answer and explanation
    Correct answer: C

    Event actions let an analyst pivot from a selected event to related activity without manually rebuilding the search. The other options describe deleting evidence, changing policy or resetting a timeline, which event actions do not do.

  4. Question 14

    A Falcon Event Search for a suspicious PowerShell pattern returns thousands of results across the fleet. Which change most effectively narrows the results to the relevant investigation?

    1. ARemove all filters, then sort the full result set alphabetically by hostname
    2. BAdd the affected host and a tighter time window around the detection to the search
    3. CWiden the time range to the last year so no relevant events are missed by accident
    4. DExport the whole result set to a spreadsheet and filter it by hand before reviewing anything
    Show answer and explanation
    Correct answer: B

    Adding the affected host and a tighter time window removes unrelated fleet activity from the results. Removing filters or widening the range adds noise, and exporting everything to filter by hand delays the review without narrowing the search.

  5. Question 15

    Which two statements about investigating from a detection in Event Search are accurate? (Choose two.)

    1. AThe search carries context from the detection, such as host and process, to narrow the results
    2. BEvents are searchable only after the detection has been closed and archived first
    3. CPivoting from the detection lets the analyst review surrounding events for the same activity
    4. DDetections replace raw event data, so searching events is unnecessary once a detection exists
    Show answer and explanation
    Correct answer: A, C

    A search started from a detection inherits its context and can pivot to surrounding events for the same activity. Raw events are searchable without closing or archiving the detection, and detections summarize events rather than replacing them.

Event Investigation (5 questions)

  1. Question 16

    An analyst wants to follow everything one suspicious process did after it launched, including child activity, network connections and file writes, in time order. Which view fits best?

    1. AHost Timeline, which shows every event on the endpoint in chronological order
    2. BHash Search, which lists every endpoint where the process's file has been seen
    3. CProcess Timeline, which shows one process's activity in chronological order
    4. DUser Search, which lists the logons associated with the account that ran the process
    Show answer and explanation
    Correct answer: C

    Process Timeline is scoped to one process and orders its activity over time. The host timeline covers the whole machine, which is too broad for this question, while hash and user searches answer different questions about where a file or account appears.

  2. Question 17

    An analyst sees winword.exe start powershell.exe shortly after a user opened a document. How should the relationship between the two processes be described?

    1. Apowershell.exe is the parent of winword.exe, because the shell must have been running first
    2. Bpowershell.exe and winword.exe are siblings, because both were started within the same session
    3. CThe two processes are unrelated, because a document application cannot start a command shell
    4. Dpowershell.exe is a child of winword.exe, because winword.exe launched it
    Show answer and explanation
    Correct answer: D

    The process that starts another process is its parent, so PowerShell is the child of Word in this case. Calling them siblings or reversing the order misreads the relationship, and a document application launching a shell is exactly why this pattern draws attention.

  3. Question 18

    Two suspicious processes on one host were both started by the same parent process within seconds of each other. Which relationship do they have?

    1. AAncestors, because the shared parent is older than both of them
    2. BParent and child, because the first process must have started the second one
    3. CSiblings, because they share the same parent process
    4. DUnrelated, because a single parent process can start only one child process
    Show answer and explanation
    Correct answer: C

    Processes that share a parent are siblings, even though neither started the other. Parent and child means a direct launch, ancestry extends across generations, and a parent can start many children, so the other options misstate the hierarchy.

  4. Question 19

    Process Explorer shows an unfamiliar process with an unusual command line. The analyst wants the files and network connections tied to that process. What is the best next step?

    1. APivot from the process to its associated events, such as file and network activity
    2. BDelete the parent process from the timeline view so it no longer appears in the tree
    3. CStop the sensor on the host so the process cannot write any more files during review
    4. DBlocklist the process by its hash now, since that also reveals the connections it made
    Show answer and explanation
    Correct answer: A

    Pivoting from the process to its associated events shows what it touched without changing the host. Stopping the sensor removes protection, deleting entries from a view does not alter the real process history, and a blocklist action does not reveal network connections.

  5. Question 20

    A responder must reconstruct everything that happened on one server over the last hour, including logons, process launches and network activity, in time order. Which view fits?

    1. AProcess Timeline, which covers a single process's activity from its launch onward
    2. BHash Search, which identifies every endpoint where a file with a given hash was observed
    3. CHost Timeline, which shows the endpoint's events across all processes in chronological order
    4. DProcess Explorer, which shows the parent-child structure of processes on the endpoint
    Show answer and explanation
    Correct answer: C

    Host Timeline covers the events of one endpoint across all processes in order, which a whole-server reconstruction needs. Process Timeline is limited to one process, and hash search and process structure views do not rebuild the full sequence.

Search Tools (5 questions)

  1. Question 21

    An analyst suspects that a remote IP address is being used for command-and-control traffic and needs to know which hosts communicated with it. Which search fits?

    1. AIP Search, which finds the hosts that communicated with the address
    2. BHost Search, which finds a host by its name, identifier or operating system
    3. CUser Search, which lists the logons and activity tied to a single account
    4. DHash Search, which finds the endpoints where a particular file has been observed
    Show answer and explanation
    Correct answer: A

    IP Search starts from a network address and returns the hosts that communicated with it, which answers the question directly. Host, user and hash searches start from different artifacts and cannot show which endpoints connected to that address.

  2. Question 22

    A threat report lists a file hash for a dropper and asks whether any endpoint has seen that file. Which search should the analyst start with?

    1. ABulk Domain Search, which matches a list of domains against endpoint network activity
    2. BHash Search, which finds every endpoint where the file was observed
    3. CProcess Timeline, which shows one host's process activity in chronological order
    4. DUser Search, which lists accounts and their recent logon activity across hosts
    Show answer and explanation
    Correct answer: B

    Hash Search starts from the file's hash and returns the endpoints where it appears, which matches the request exactly. Domain, account and single-host timeline searches begin from different indicators and cannot answer which endpoints handled this file.

  3. Question 23

    An incident responder receives a list of 150 domains tied to a phishing campaign and needs to know which hosts contacted any of them. Which approach is most efficient?

    1. AHash Search, by treating each domain name as if it were a file hash
    2. BBulk Domain Search, which checks many domains against endpoint activity in one search
    3. CUser Search, which lists every account that opened each domain in a browser
    4. DHost Search, which lists hosts by operating system version and last check-in time
    Show answer and explanation
    Correct answer: B

    Bulk Domain Search is built to check a long list of domains in one pass, which suits a campaign indicator list. The other options misuse hash, account or inventory searches for a domain-matching task.

  4. Question 24

    A help desk ticket reports that a contractor account may have been misused. The analyst needs the hosts tied to that account and the activity associated with it. Which search fits?

    1. AUser Search, which pivots from the account to the hosts and activity tied to it
    2. BIP Search, which lists hosts that communicated with a specific network address
    3. CHash Search, which lists endpoints where a particular file has been observed
    4. DHost Search, which finds a single host by name and reports its current status
    Show answer and explanation
    Correct answer: A

    User Search pivots from an account to the hosts and activity associated with that account, which matches the ticket. Hash, IP and host searches start from a file, a network address or a machine identity, so they do not answer the account-centred question.

  5. Question 25

    Before starting a live session, an analyst needs to confirm the exact name, status and identifiers of a workstation a user reported. Which search should be used?

    1. AHash Search, which finds endpoints where a particular file has been observed
    2. BIP Search, which lists hosts that communicated with a specific network address
    3. CUser Search, which lists accounts and the logon activity tied to each one
    4. DHost Search, which finds a host by its identifiers and shows its current details
    Show answer and explanation
    Correct answer: D

    Host Search locates a machine by its identifiers and shows its details, including status, which the analyst needs before connecting. The other searches start from a file, a network address or an account, so they cannot confirm the workstation's own record.

Real Time Response (RTR) (5 questions)

  1. Question 26

    An endpoint in a remote office may be compromised. The incident team needs to look at running processes and live network connections without shipping the device. Which Falcon capability fits?

    1. ASensor policy editing, which changes how the endpoint protects itself but shows no process data
    2. BBulk Domain Search, which matches a list of domains against stored network activity
    3. CA Real Time Response session, which gives live command access to processes and connections
    4. DRestoring the endpoint from a backup, which rebuilds the device's software state from an image
    Show answer and explanation
    Correct answer: C

    Real Time Response provides live command access to a connected endpoint, including process and network inspection, without physical access. Policy edits, domain searches and backup restores do not give on-demand live visibility into a running host.

  2. Question 27

    An analyst tries to open a Real Time Response session on a laptop, but the host shows as offline in the console. What is the most appropriate action?

    1. AWait for the sensor to reconnect, then start the session once the host shows as online
    2. BRun a custom script on the laptop first, since scripts are the only way to wake an offline host
    3. CUse IP Search to force the sensor to reconnect, which also opens the session automatically
    4. DOpen the audit log and resume a cached session that was recorded for the offline laptop
    Show answer and explanation
    Correct answer: A

    A live session needs a connected sensor, so the analyst waits for the host to come back online (commands can be queued for offline hosts but only run once it reconnects). The other options assume that scripts, searches or audit logs can wake an offline host or create a session, which they cannot do.

  3. Question 28

    During a live Real Time Response session, the analyst confirms that a malicious process is still running and must be stopped on the host right away. Which command fits?

    1. Akill, which terminates a running process identified by its process ID
    2. Bls, which lists the contents of the current directory on the host
    3. Cget, which copies a file from the host back to the analyst's console
    4. Dnetstat, which lists the network connections currently open on the host
    Show answer and explanation
    Correct answer: A

    The kill command terminates a process by its process ID, which stops the running activity. The other commands list directories, copy files or show network connections, which help an investigation but do not stop a running process.

  4. Question 29

    A manager asks who ran a remediation command on a server during an RTR session last week. Where should the analyst look first?

    1. AThe detections page, which lists sensor alerts and their triage status
    2. BHost Search, which shows the host's current status and identifiers
    3. CPolicy change history, which records only changes made to protection settings
    4. DRTR audit logs, which record the commands run during sessions
    Show answer and explanation
    Correct answer: D

    RTR audit logs record session activity and commands, which supports accountability for remediation work. Detection and host views show alerts and current state, and policy change history tracks settings rather than the commands an operator ran.

  5. Question 30

    An analyst with read-only Falcon permissions finds that a host needs a remediation command run through RTR. What is the correct response?

    1. ARun the command anyway, since RTR works on any host that is online and reachable
    2. BRequest the RTR permission through the administrator, since remediation needs elevated roles
    3. CUse a colleague's administrator login for a single session, so the change is completed quickly
    4. DExport the host's configuration and make the change offline, since RTR is never needed for remediation
    Show answer and explanation
    Correct answer: B

    RTR permissions are role-based, and commands that change or remove things on a host require elevated roles granted by an administrator. Running commands anyway, borrowing another person's login and making offline changes all bypass the access controls that keep remediation accountable.