CCFR Practice Test

CCFR practice test: what's covered

• Falcon Console
• Detections
• Host Search
• Process Timeline
• Real Time Response
• Containment

Free CCFR sample questions

1. A responder opens a high-severity Falcon detection showing a suspicious PowerShell process with encoded command line. Which response is the BEST fit?

   • A. Review the detection details, process tree, command line, user, host, and related indicators before deciding containment
   • B. Close the detection because PowerShell is a Microsoft binary
   • C. Contain the entire subnet before reading the process tree
   • D. Delete the detection so it cannot page the queue again
   Show answer

   Correct: A. Review the detection details, process tree, command line, user, host, and related indicators before deciding containment is the best answer because Falcon response starts with validating detection context and understanding process lineage. The other choices do not fit the scenario: Close the detection because PowerShell is a Microsoft binary addresses the wrong layer or timing, Contain the entire subnet before reading the process tree skips a required control, and Delete the detection so it cannot page the queue again would create avoidable operational or security risk.

2. Multiple detections on the same host appear to be part of one attack chain. Which response is the BEST fit?

   • A. Group or relate the detections during triage and assign ownership so one responder drives the investigation
   • B. Assign each detection to a different analyst with no shared notes
   • C. Mark all but the newest detection as duplicates without review
   • D. Change the host prevention policy instead of triaging
   Show answer

   Correct: A. Group or relate the detections during triage and assign ownership so one responder drives the investigation is the best answer because grouping related detections preserves context and avoids fragmented response. The other choices do not fit the scenario: Assign each detection to a different analyst with no shared notes addresses the wrong layer or timing, Mark all but the newest detection as duplicates without review skips a required control, and Change the host prevention policy instead of triaging would create avoidable operational or security risk.

3. A detection appears on a domain controller and the tactic suggests credential access. Which response is the BEST fit?

   • A. Increase priority, validate the activity quickly, and prepare containment with business-impact coordination
   • B. Treat it like a low-value kiosk alert
   • C. Wait several days because domain controllers are noisy
   • D. Disable all detections for domain controllers
   Show answer

   Correct: A. Increase priority, validate the activity quickly, and prepare containment with business-impact coordination is the best answer because asset criticality and tactic matter; domain controller credential access can have enterprise-wide impact. The other choices do not fit the scenario: Treat it like a low-value kiosk alert addresses the wrong layer or timing, Wait several days because domain controllers are noisy skips a required control, and Disable all detections for domain controllers would create avoidable operational or security risk.

4. A responder must document work on a Falcon detection for handoff. Which TWO choices should the engineer select? (Choose TWO)

   • A. Add clear comments describing evidence and decisions
   • B. Update status and assignment according to the response workflow
   • C. Leave the detection unassigned after containment
   • D. Store all notes only in a private text file on the analyst laptop
   Show answer

   Correct: A and B. Add clear comments describing evidence and decisions and Update status and assignment according to the response workflow are correct because Falcon workflows depend on visible status, assignment, and comments so the team can audit and continue the case. The distractors do not satisfy the requirement: Leave the detection unassigned after containment is incomplete for this case, and Store all notes only in a private text file on the analyst laptop solves a different problem or weakens the design.

5. A low-severity detection repeats across many developer workstations after a new build tool rollout. Which response is the BEST fit?

   • A. Validate the executable, signer, path, and behavior, then tune with an exception only if it is confirmed benign and scoped tightly
   • B. Disable the prevention policy for all developers forever
   • C. Mark every future unknown executable as allowed
   • D. Ignore the detections because developers create noise
   Show answer

   Correct: A. Validate the executable, signer, path, and behavior, then tune with an exception only if it is confirmed benign and scoped tightly is the best answer because tuning should be evidence-based and narrow so it reduces false positives without creating blind spots. The other choices do not fit the scenario: Disable the prevention policy for all developers forever addresses the wrong layer or timing, Mark every future unknown executable as allowed skips a required control, and Ignore the detections because developers create noise would create avoidable operational or security risk.

Last updated: 2026-10-19

CCFR practice test FAQ