CrowdStrike Updated CCFR-201b Exam Questions and Answers by kyle

CrowdStrike’s RTR requirements distinguish between the minimum supported PowerShell version and the recommended version. PowerShell 3.0 or later is recommended, but PowerShell 2.0 is the minimum required version for RTR on Windows. Because the question asks specifically for the required minimum, option B is correct. Selecting version 3.0 would confuse the recommended baseline with the lowest supported baseline. Versions 3.5 and 4.5 are not valid PowerShell release choices in the way presented and do not match Falcon’s documented requirement. PowerShell is important because RTR scripts on Windows execute through the host’s PowerShell environment, subject to other requirements such as supported sensor versions, policy permissions, and the absence of constrained language mode.

================

Falcon event records use event_simpleName to identify the event type, such as ProcessRollup2, DnsRequest, or FileWritten. In CrowdStrike Query Language, the field is commonly referenced as #event_simpleName. Filtering this field limits the timeline to the event classes relevant to the investigation while preserving the host and time context. The alternatives shown are not standard Falcon event-type fields: #event_Name and #event_simpleType do not represent the documented event-name field, and #event_timelineName would describe neither the raw event type nor a supported built-in filter. A responder can therefore modify #event_simpleName to focus the Host Timeline on process, network, file, registry, or other specific telemetry events without changing the underlying host selection.

================