Pass Your Exam With 100% Verified CCFH-202 Exam Questions [Q20-Q41]

5/5 - (1 vote)

Pass Your Exam With 100% Verified CCFH-202 Exam Questions

CCFH-202 Dumps PDF – CCFH-202 Real Exam Questions Answers

CrowdStrike CCFH-202 Exam Syllabus Topics:

Topic	Details
Topic 1	Explain what information a Hash Execution Search provides Explain what information a Bulk Domain Search provides
Topic 2	Explain what information a Mac Sensor Report will provide Conduct hypothesis and hunting lead generation to prove them out using Falcon tools
Topic 3	Demonstrate how to get a Process Timeline Analyze and recognize suspicious overt malicious behaviors
Topic 4	Utilize the MITRE ATT&CK Framework to model threat actor behaviors Explain what information a bulk (Destination) IP search provides
Topic 5	Locate built-in Hunting reports and explain what they provide Identify alternative analytical interpretations to minimize and reduce false positives
Topic 6	From the Statistics tab, use the left click filters to refine your search Explain what the “join” command does and how it can be used to join disparate queries
Topic 7	Convert and format Unix times to UTC-readable time Evaluate information for reliability, validity and relevance for use in the process of elimination
Topic 8	Explain what information is in the Hunting & Investigation Guide Differentiate testing, DevOps or general user activity from adversary behavior
Topic 9	Explain what information a Source IP Search provides Explain what the “table” command does and demonstrate how it can be used for formatting output

NEW QUESTION 20
Which tool allows a threat hunter to populate and colorize all known adversary techniques in a single view?

MISP

OWASP Threat Dragon

OpenXDR

MITRE ATT&CK Navigator

NEW QUESTION 21
What is the difference between a Host Search and a Host Timeline?

Host Search is used for detection investigation and Host Timeline is used for proactive hunting

A Host Search organizes the data in useful event categories like process executions and network connections, a Host Timeline provides an uncategorized view of recorded events in chronological order

You access a Host Search from a detection to show you every recorded process event related to the detection and you can only populate the Host Timeline fields manually

There is no difference. You just get to them different ways

NEW QUESTION 22
To view Files Written to Removable Media within a specified timeframe on a host within the Host Search page, expand and refer to the _______dashboard panel.

Command Line and Admin Tools

Processes and Services

Registry, Tasks, and Firewall

Suspicious File Activity

NEW QUESTION 23
In which of the following stages of the Cyber Kill Chain does the actor not interact with the victim endpoint(s)?

Exploitation

Weaponization

Command & control

Installation

NEW QUESTION 24
You want to produce a list of all event occurrences along with selected fields such as the full path, time, username etc. Which command would be the appropriate choice?

fields

distinct count

table

values

NEW QUESTION 25
What information is provided from the MITRE ATT&CK framework in a detection’s Execution Details?

Grouping Tag

Command Line

Technique ID

Triggering Indicator

NEW QUESTION 26
Which of the following is a recommended technique to find unique outliers among a set of data in the Falcon Event Search?

Hunt-and-Peck Search Methodology

Stacking (Frequency Analysis)

Time-based Searching

Machine Learning

NEW QUESTION 27
Which structured analytic technique contrasts different hypotheses to determine which is the best leading (prioritized) hypothesis?

Model hunting framework

Competitive analysis

Analysis of competing hypotheses

Key assumptions check

NEW QUESTION 28
Which Falcon documentation guide should you reference to hunt for anomalies related to scheduled tasks and other Windows related artifacts?

Hunting and Investigation

MITRE-Based Falcon Detections Framework

Events Data Dictionary

Customizable Dashboards

NEW QUESTION 29
Which of the following is an example of a Falcon threat hunting lead?

A routine threat hunt query showing process executions of single letter filename (e.g., a.exe) from temporary directories

Security appliance logs showing potentially bad traffic to an unknown external IP address

A help desk ticket for a user clicking on a link in an email causing their machine to become unresponsive and have high CPU usage

An external report describing a unique 5 character file extension for ransomware encrypted files

NEW QUESTION 30
Which of the following would be the correct field name to find the name of an event?

Event_SimpleName

Event_Simple_Name

EVENT_SIMPLE_NAME

event_simpleName

NEW QUESTION 31
Event Search data is recorded with which time zone?

PST

GMT

EST

UTC

NEW QUESTION 32
What Investigate tool would you use to allow an analyst to view all events for a specific host?

Bulk Timeline

Host Search

Host Timeline

Process Timeline

NEW QUESTION 33
Which of the following queries will return the parent processes responsible for launching badprogram exe?

[search (ParentProcess) where name=badprogranrexe ] | table ParentProcessName _time

event_simpleName=processrollup2 [search event_simpleName=processrollup2 FileName=badprogram.exe | rename ParentProcessld_decimal AS TargetProcessld_decimal | fields aid TargetProcessld_decimal] | stats count by FileName _time

[search (ProcessList) where Name=badprogram.exe ] | search ParentProcessName | table ParentProcessName _time

event_simpleName=processrollup2 [search event_simpleName=processrollup2 FileName=badprogram.exe | rename TargetProcessld_decimal AS ParentProcessld_decimal | fields aid TargetProcessld_decimal] | stats count by FileName _time

NEW QUESTION 34
A benefit of using a threat hunting framework is that it:

Automatically generates incident reports

Eliminates false positives

Provides high fidelity threat actor attribution

Provides actionable, repeatable steps to conduct threat hunting

NEW QUESTION 35
How do you rename fields while using transforming commands such as table, chart, and stats?

By renaming the fields with the “rename” command after the transforming command e.g. “stats count by ComputerName | rename count AS total_count”

You cannot rename fields as it would affect sub-queries and statistical analysis

By using the “renamed” keyword after the field name eg “stats count renamed totalcount by ComputerName”

By specifying the desired name after the field name eg “stats count totalcount by ComputerName”

NEW QUESTION 36
You would like to search for ANY process execution that used a file stored in the Recycle Bin on a Windows host. Select the option to complete the following EAM query.

*$Recycle Bin^

*$Recycle Bin*

^$Recycle Bin*

^$Recycle.Bin%^

NEW QUESTION 37
The Falcon Detections page will attempt to decode Encoded PowerShell Command line parameters when which PowerShell Command line parameter is present?

-Command

-Hidden

-e

-nop

NEW QUESTION 38
What elements are required to properly execute a Process Timeline?

Agent ID (AID) and Target Process ID

Agent ID (AID) only

Hostname and Local Process ID

Target Process ID only

NEW QUESTION 39
What kind of activity does a User Search help you investigate?

A history of Falcon Ul logon activity

A list of process activity executed by the specified user account

A count of failed user logon activity

A list of DNS queries by the specified user account

NEW QUESTION 40
Which of the following is an example of actor actions during the RECONNAISSANCE phase of the Cyber Kill Chain?

Installing a backdoor on the victim endpoint

Discovering internet-facing servers

Emailing the intended victim with a malware attachment

Loading a malicious payload into a common DLL

NEW QUESTION 41
Which of the following best describes the purpose of the Mac Sensor report?

The Mac Sensor report displays a listing of all Mac hosts without a Falcon sensor installed

The Mac Sensor report provides a detection focused view of known malicious activities occurring on Mac hosts, including machine-learning and indicator-based detections

The Mac Sensor report displays a listing of all Mac hosts with a Falcon sensor installed

The Mac Sensor report provides a comprehensive view of activities occurring on Mac hosts, including items of interest that may be hunting or investigation leads