CrowdStrike Exam CCFH-202 Topic 9 Question 33 Discussion

Actual exam question for CrowdStrike's CCFH-202 exam

Question #: 33
Topic #: 9

[All CCFH-202 Questions]

What kind of activity does a User Search help you investigate?

AA history of Falcon Ul logon activity

BA list of process activity executed by the specified user account

CA count of failed user logon activity

DA list of DNS queries by the specified user account

Show Suggested Answer

Suggested Answer: B

User Search is an Investigate tool that helps you investigate a list of process activity executed by the specified user account. It shows information such as process name, command line, parent process name, parent command line, etc. for each process that was executed by the user account on any host in your environment. It does not show a history of Falcon UI logon activity, a count of failed user logon activity, or a list of DNS queries by the specified user account.

by Clay at Oct 21, 2024, 12:26 PM

Limited Time Offer

25%

1 months ago

Option B seems the most relevant to me. A user search should provide details on the processes executed by a specific user account.

upvoted 0 times

Norah

16 days ago

That information can give us valuable insights into what the user has been doing.

upvoted 0 times

...

Lindsey

23 days ago

It's important to know the list of process activity executed by the specified user account.

upvoted 0 times

...

Staci

26 days ago

I agree, option B is definitely the most relevant for investigating user activity.

upvoted 0 times

...

Phillip

1 months ago

I agree with Ashley, because it can provide valuable insights into user behavior and potential security issues.

upvoted 0 times

...

Ashley

2 months ago

I think a User Search helps investigate B) A list of process activity executed by the specified user account.

upvoted 0 times

...