CrowdStrike CCFR-201b Exam - Topic 1 Question 4 Discussion

Actual exam question for CrowdStrike's CCFR-201b exam

Question #: 4
Topic #: 1

After running an Event Search, you can select many Event Actions depending on your results. Which of the following is NOT an option for any Event Action?

ADraw Process Explorer

BShow a +/- 10-minute window of events

CShow a Process Timeline for the responsible process

DShow Associated Event Data (from TargetProcessld_decimal or ContextProcessld_decimal)

Show Suggested Answer

Suggested Answer: A

According to theCrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Event Search tool allows you to search for events based on various criteria, such as event type, timestamp, hostname, IP address, etc1.You can also select one or more events and perform various actions, such as show a process timeline, show a host timeline, show associated event data, show a +/- 10-minute window of events, etc1.However, there is no option to draw a process explorer, which is a graphical representation of the process hierarchy and activity1.

by Sunny at Jan 22, 2026, 04:22 PM

Limited Time Offer

25%

Off

Get Premium CCFR-201b Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Melynda

4 days ago

I think D is the right answer.

upvoted 0 times

...

Aliza

9 days ago

Hmm, I'm not sure about this one. Maybe B) Show a +/- 10-minute window of events? That could be a handy feature.

upvoted 0 times

...

Carli

14 days ago

I'm going with C) Show a Process Timeline for the responsible process. That seems like the most useful Event Action to me.

upvoted 0 times

...

Adela

20 days ago

Haha, I bet the correct answer is A) Draw Process Explorer. That sounds like something a developer would wish for, but it's definitely not a real option.

upvoted 0 times

...

Shawnee

25 days ago

D) Show Associated Event Data seems like the most logical choice here. The other options are all valid Event Actions.

upvoted 0 times

...

Mitsue

30 days ago

I think the answer is A) Draw Process Explorer, since that's not an actual Event Action option.

upvoted 0 times

...

Norah

1 month ago

I’m pretty sure that showing a Process Timeline is definitely an option, but I can't remember if all of these are valid actions.

upvoted 0 times

...

Phillip

1 month ago

I’m a bit confused about the "Show Associated Event Data" option. It sounds familiar, but I can't recall if it's standard for Event Actions.

upvoted 0 times

...

Sherrell

2 months ago

I feel like I've seen a question similar to this in practice, and I think "Draw Process Explorer" is a common action.

upvoted 0 times

...

Teri

2 months ago

I think I remember that the Event Actions usually include options to visualize processes, but I'm not sure about the +/- 10-minute window.

upvoted 0 times

...

Sherly

2 months ago

Ah, I see what they're getting at. I'll make sure to eliminate the options that are valid Event Actions.

upvoted 0 times

...

Brittni

3 months ago

I'm pretty confident I know the answer, but I want to double-check my understanding before submitting.

upvoted 0 times

...

Xenia

3 months ago

Okay, let me see... I think the key is to focus on which of these is not an option for any Event Action.

upvoted 0 times

...

Mayra

3 months ago

I'm a bit confused on the difference between some of these options. I'll have to review the details.

upvoted 0 times

...

Earnestine

3 months ago

Hmm, this one seems tricky. I'll need to think through the different Event Actions carefully.

upvoted 0 times

...