CCFR-201b CrowdStrike Certified Falcon Responder Free Practice Exam Questions (2026 Updated)

A DnsRequest event records the process that originated the DNS activity in ContextProcessId, while aid identifies the Falcon sensor installation, and therefore the host, that produced the event. A Process Timeline needs both the host identity and the process identity. Using ContextProcessId with aid lets Falcon retrieve the other cloudable events associated with that responsible process during the chosen period. ParentProcessId identifies the parent rather than the process that made the request. RequestType describes the DNS record type, such as A or AAAA, and cannot identify a process. ResponsibleProcessId is not the required field in this event. Therefore, ContextProcessId and aid are the correct pair for pivoting from the DnsRequest event to the originating process’s timeline.

================

The correct fix is to set the -timeout argument to a longer period. Custom remediation scripts can take longer than expected, especially when they enumerate files, remove persistence entries, clean adware components, or wait for operating-system operations to complete. If the script is valid but exceeds the default execution window, extending the timeout gives RTR enough time to complete the task. Setting timeout to “off” is not the correct approach because response commands should still have controlled execution limits. Simply rerunning the script may reproduce the same timeout failure. Changing a console-wide timeout policy is unnecessary when the command-level timeout argument can solve the issue directly. In RTR remediation, tuning execution parameters is often required for longer-running scripts.

The fastest Falcon Platform action to stop active data exfiltration from a known endpoint is network containment. Containing Bob-Desktop from the Falcon console restricts network communication while preserving Falcon sensor connectivity for investigation and response. This is better than trying to create an IOA or IOC for a specific destination IP because the adversary may change infrastructure, use multiple destinations, or already have active sessions. Accessing the host through RTR can support follow-up investigation, but the immediate containment action should be initiated from the Falcon console. The objective is not just to detect future traffic; it is to stop current outbound communication. Network containment is the direct responder action for isolating a host involved in suspected exfiltration.

CrowdStrike’s RTR requirements distinguish between the minimum supported PowerShell version and the recommended version. PowerShell 3.0 or later is recommended, but PowerShell 2.0 is the minimum required version for RTR on Windows. Because the question asks specifically for the required minimum, option B is correct. Selecting version 3.0 would confuse the recommended baseline with the lowest supported baseline. Versions 3.5 and 4.5 are not valid PowerShell release choices in the way presented and do not match Falcon’s documented requirement. PowerShell is important because RTR scripts on Windows execute through the host’s PowerShell environment, subject to other requirements such as supported sensor versions, policy permissions, and the absence of constrained language mode.

================

The correct field is FilePath because the investigation is focused on events executing from a specific directory on the host. In Falcon Event Search, path-based filtering is used when a responder wants to identify activity tied to a folder location such as a user profile, temp directory, startup folder, or suspicious staging path. TreeId is related to process lineage and is not the right field for directory matching. @source identifies the data source or index-related context, not the executable location. ParentBaseFileName is useful when searching for child processes launched by a specific parent executable, but it does not identify where the executing file resides. FilePath directly maps to the file location, making it the correct field for directory-based event hunting.

The correct approach is to use a workflow that triggers from a new endpoint detection, queries the endpoint telemetry for known artifacts, and then uses the built-in “Remove All Associated Artifacts” action. This is stronger than simply blocking execution because the scenario requires cleanup of multiple artifact types: an executable, a startup shortcut, and a registry Run key. A Custom IOA can prevent or detect behavior, but it does not automatically remove all related artifacts already present on the host. A quarantine rule is also too narrow because not all artifacts are files suitable for quarantine, especially registry persistence. Using Falcon workflow automation makes the remediation repeatable for future detections and reduces manual responder effort while preserving consistent artifact removal logic across impacted endpoints.