Free Preparation Discussions
MENU
CrowdStrike CCFH-202 Exam Questions
- Topic 1: Utilize the MITRE ATT&CK Framework to model threat actor behaviors/ Explain what information a bulk (Destination) IP search provides
- Topic 2: Explain what information a Mac Sensor Report will provide/ Conduct hypothesis and hunting lead generation to prove them out using Falcon tools
- Topic 3: Identify the vulnerability exploited from an initial attack vector/ Explain what information is in the Events Data Dictionary
- Topic 4: Explain what information a Hash Execution Search provides/ Explain what information a Bulk Domain Search provides
- Topic 5: Locate built-in Hunting reports and explain what they provide/ Identify alternative analytical interpretations to minimize and reduce false positives
- Topic 6: Explain what information is in the Hunting & Investigation Guide/ Differentiate testing, DevOps or general user activity from adversary behavior
- Topic 7: From the Statistics tab, use the left click filters to refine your search/ Explain what the “join” command does and how it can be used to join disparate queries
- Topic 8: Convert and format Unix times to UTC-readable time/ Evaluate information for reliability, validity and relevance for use in the process of elimination
- Topic 9: Explain what information a Source IP Search provides/ Explain what the “table” command does and demonstrate how it can be used for formatting output
- Topic 10: Demonstrate how to get a Process Timeline/ Analyze and recognize suspicious overt malicious behaviors
Free CrowdStrike CCFH-202 Exam Actual Questions
Note: Premium Questions for CCFH-202 were last updated On Jan. 19, 2025 (see below)
Where would an analyst find information about shells spawned by root, Kernel Module loads, and wget/curl usage?
The Linux Sensor report is where an analyst would find information about shells spawned by root, Kernel Module loads, and wget/curl usage. The Linux Sensor report is a pre-defined report that provides a summary view of selected activities on Linux hosts. It shows information such as process execution events, network connection events, file write events, etc. that occurred on Linux hosts within a specified time range. The Sensor Health report, the Sensor Policy Daily report, and the Mac Sensor report do not provide the same information.
What information is provided when using IP Search to look up an IP address?
IP Search is an Investigate tool that allows you to look up information about external IPs only. It shows information such as geolocation, network connection events, detection history, etc. for each external IP address that has communicated with your hosts. It does not show information about internal IPs, suspicious IPs, or both internal and external IPs.
Where would an analyst find information about shells spawned by root, Kernel Module loads, and wget/curl usage?
The Linux Sensor report is where an analyst would find information about shells spawned by root, Kernel Module loads, and wget/curl usage. The Linux Sensor report is a pre-defined report that provides a summary view of selected activities on Linux hosts. It shows information such as process execution events, network connection events, file write events, etc. that occurred on Linux hosts within a specified time range. The Sensor Health report, the Sensor Policy Daily report, and the Mac Sensor report do not provide the same information.
Which of the following is a way to create event searches that run automatically and recur on a schedule that you set?
Scheduled Searches are a way to create event searches that run automatically and recur on a schedule that you set. You can use Scheduled Searches to monitor your environment for specific conditions or patterns, generate reports or alerts, or enrich your data with additional fields or tags. Workflows, Event Search, and Scheduled Reports are not ways to create event searches that run automatically and recur on a schedule.
What kind of activity does a User Search help you investigate?
User Search is an Investigate tool that helps you investigate a list of process activity executed by the specified user account. It shows information such as process name, command line, parent process name, parent command line, etc. for each process that was executed by the user account on any host in your environment. It does not show a history of Falcon UI logon activity, a count of failed user logon activity, or a list of DNS queries by the specified user account.
- Select Question Types you want
- Set your Desired Pass Percentage
- Allocate Time (Hours : Minutes)
- Create Multiple Practice tests with Limited Questions
- Customer Support
Andrew
8 days agoGregoria
11 days agoIsabella
26 days agoSunny
27 days agoMargarita
1 months agoKris
1 months agoLaticia
2 months agoDaniel
2 months agoHyun
2 months agoFlo
2 months agoNaomi
3 months agoChauncey
3 months agoCordelia
3 months agoNatalie
3 months agoWhitley
3 months agoLashaunda
4 months agoBronwyn
4 months agoGracie
4 months agoAileen
4 months agoZack
4 months agoElise
5 months agoEvangelina
5 months agoJesus
5 months agoIsreal
5 months agoHaydee
6 months agoLouisa
6 months agoIvette
7 months agoKathrine
7 months agoGiovanna
8 months agoProvidencia
8 months agoNorah
8 months agoReed
9 months ago