CrowdStrike Updated CCFR-201b Exam Questions and Answers by julius

The native RTR command for deleting a file or directory is rm. To remove a non-empty directory, the operation must be recursive, represented by r, and force removal is represented by f. Combining those switches produces rm followed by the quoted directory path and -rf. Quoting the Windows path ensures that the complete path is handled as one argument, which is especially important when paths contain spaces. The remove command shown in options A and D is not the native RTR command name for this operation, and -force is not the syntax presented by the choices. Because the task explicitly requires deleting the folder and everything beneath it, rm " C:\Windows\BadTools " -rf is the only option combining the correct command with recursive forced removal.

================

SyntheticProcessRollup2 provides process data similar to ProcessRollup2, but it is generated for a process that was already running before the Falcon sensor started observing the host. A common example is a long-lived operating-system process that began before sensor installation or before the sensor service started. Because Falcon did not witness the original process-creation moment, it creates synthetic process telemetry so the process can still be represented and related to later activity. The event is not created by an analyst, OverWatch, or Charlotte AI, and it is not a fusion of human-added context. Its purpose is to preserve process visibility when the process predates sensor observation. Therefore, option D accurately describes when SyntheticProcessRollup2 is found.

================