An analyst is triaging a detection that has been categorized under the ‘Follow Through’ Objective...

Vendor: CrowdStrike
Product: CCFR-201b
Update on: Jul 21, 2026
Questions: 209

CrowdStrike CCFR-201b Question Answer

An analyst is triaging a detection that has been categorized under the ‘Follow Through’ Objective Layer. Based on the Falcon technical documentation, which of the following adversary tactics is most likely to be observed within this specific layer?

Credential Access through memory scraping

Collection of sensitive data for exfiltration

Initial Access via a drive-by download

Discovery of local network shares and services