Ultimate Guide to Prepare Free CrowdStrike CCFH-202 Exam Questions & Answer [Q19-Q33]

Rate this post

Ultimate Guide to Prepare Free CrowdStrike CCFH-202 Exam Questions and Answer

Pass CrowdStrike CCFH-202 Tests Engine pdf – All Free Dumps

CrowdStrike CCFH-202 Exam Syllabus Topics:

Topic	Details
Topic 1	Identify the vulnerability exploited from an initial attack vector Explain what information is in the Events Data Dictionary
Topic 2	Explain what information a Hash Execution Search provides Explain what information a Bulk Domain Search provides
Topic 3	Convert and format Unix times to UTC-readable time Evaluate information for reliability, validity and relevance for use in the process of elimination
Topic 4	Explain what information a Mac Sensor Report will provide Conduct hypothesis and hunting lead generation to prove them out using Falcon tools
Topic 5	From the Statistics tab, use the left click filters to refine your search Explain what the “join” command does and how it can be used to join disparate queries
Topic 6	Utilize the MITRE ATT&CK Framework to model threat actor behaviors Explain what information a bulk (Destination) IP search provides
Topic 7	Explain what information a Source IP Search provides Explain what the “table” command does and demonstrate how it can be used for formatting output
Topic 8	Explain what information is in the Hunting & Investigation Guide Differentiate testing, DevOps or general user activity from adversary behavior
Topic 9	Locate built-in Hunting reports and explain what they provide Identify alternative analytical interpretations to minimize and reduce false positives

Q19. What Investigate tool would you use to allow an analyst to view all events for a specific host?

Bulk Timeline

Host Search

Host Timeline

Process Timeline

Q20. An analyst has sorted all recent detections in the Falcon platform to identify the oldest in an effort to determine the possible first victim host What is this type of analysis called?

Visualization of hosts

Statistical analysis

Temporal analysis

Machine Learning

Q21. You want to produce a list of all event occurrences along with selected fields such as the full path, time, username etc. Which command would be the appropriate choice?

fields

distinct count

table

values

Q22. Which of the following queries will return the parent processes responsible for launching badprogram exe?

[search (ParentProcess) where name=badprogranrexe ] | table ParentProcessName _time

event_simpleName=processrollup2 [search event_simpleName=processrollup2 FileName=badprogram.exe | rename ParentProcessld_decimal AS TargetProcessld_decimal | fields aid TargetProcessld_decimal] | stats count by FileName _time

[search (ProcessList) where Name=badprogram.exe ] | search ParentProcessName | table ParentProcessName _time

event_simpleName=processrollup2 [search event_simpleName=processrollup2 FileName=badprogram.exe | rename TargetProcessld_decimal AS ParentProcessld_decimal | fields aid TargetProcessld_decimal] | stats count by FileName _time

Q23. When performing a raw event search via the Events search page, what are Event Actions?

Event Actions contains an audit information log of actions an analyst took in regards to a specific detection

Event Actions contains the summary of actions taken by the Falcon sensor such as quarantining a file, prevent a process from executing or taking no actions and creating a detection only

Event Actions are pivotable workflows including connecting to a host, pre-made event searches and pivots to other investigatory pages such as host search

Event Actions is the field name that contains the event name defined in the Events Data Dictionary such as ProcessRollup, SyntheticProcessRollup, DNS request, etc

Q24. Which of the following is a suspicious process behavior?

PowerShell running an execution policy of RemoteSigned

An Internet browser (eg, Internet Explorer) performing multiple DNS requests

PowerShell launching a PowerShell script

Non-network processes (eg, notepad exe) making an outbound network connection

Q25. In the Powershell Hunt report, what does the filtering condition of commandLine! =”*badstring* ” do?

Prevents command lines containing “badstring” from being displayed

Displays only the command lines containing “badstring”

Highlights “badstring” in all command lines in the output

Highlights only the command lines containing “badstring”

Q26. Lateral movement through a victim environment is an example of which stage of the Cyber Kill Chain?

Command & Control

Actions on Objectives

Exploitation

Delivery

Q27. You would like to search for ANY process execution that used a file stored in the Recycle Bin on a Windows host. Select the option to complete the following EAM query.

*$Recycle Bin^

*$Recycle Bin*

^$Recycle Bin*

^$Recycle.Bin%^

Q28. What information is shown in Host Search?

Quarantined Files

Prevention Policies

Intel Reports

Processes and Services

Q29. The help desk is reporting an increase in calls related to user accounts being locked out over the last few days. You suspect that this could be an attack by an adversary against your organization. Select the best hunting hypothesis from the following:

A zero-day vulnerability is being exploited on a Microsoft Exchange server

A publicly available web application has been hacked and is causing the lockouts

Users are locking their accounts out because they recently changed their passwords

A password guessing attack is being executed against remote access mechanisms such as VPN

Q30. Which of the following is a recommended technique to find unique outliers among a set of data in the Falcon Event Search?

Hunt-and-Peck Search Methodology

Stacking (Frequency Analysis)

Time-based Searching

Machine Learning

Q31. Which of the following best describes the purpose of the Mac Sensor report?

The Mac Sensor report displays a listing of all Mac hosts without a Falcon sensor installed

The Mac Sensor report provides a detection focused view of known malicious activities occurring on Mac hosts, including machine-learning and indicator-based detections

The Mac Sensor report displays a listing of all Mac hosts with a Falcon sensor installed

The Mac Sensor report provides a comprehensive view of activities occurring on Mac hosts, including items of interest that may be hunting or investigation leads

Q32. SPL (Splunk) eval statements can be used to convert Unix times (Epoch) into UTC readable time Which eval function is correct^

now

typeof

strftime

relative time

Q33. Which Falcon documentation guide should you reference to hunt for anomalies related to scheduled tasks and other Windows related artifacts?

Hunting and Investigation

MITRE-Based Falcon Detections Framework

Events Data Dictionary

Customizable Dashboards