Free Preparation Discussions
MENU
CrowdStrike CCFH-202 Exam Questions
- Topic 1: Utilize the MITRE ATT&CK Framework to model threat actor behaviors/ Explain what information a bulk (Destination) IP search provides
- Topic 2: Explain what information a Mac Sensor Report will provide/ Conduct hypothesis and hunting lead generation to prove them out using Falcon tools
- Topic 3: Identify the vulnerability exploited from an initial attack vector/ Explain what information is in the Events Data Dictionary
- Topic 4: Explain what information a Hash Execution Search provides/ Explain what information a Bulk Domain Search provides
- Topic 5: Locate built-in Hunting reports and explain what they provide/ Identify alternative analytical interpretations to minimize and reduce false positives
- Topic 6: Explain what information is in the Hunting & Investigation Guide/ Differentiate testing, DevOps or general user activity from adversary behavior
- Topic 7: From the Statistics tab, use the left click filters to refine your search/ Explain what the “join” command does and how it can be used to join disparate queries
- Topic 8: Convert and format Unix times to UTC-readable time/ Evaluate information for reliability, validity and relevance for use in the process of elimination
- Topic 9: Explain what information a Source IP Search provides/ Explain what the “table” command does and demonstrate how it can be used for formatting output
- Topic 10: Demonstrate how to get a Process Timeline/ Analyze and recognize suspicious overt malicious behaviors
Free CrowdStrike CCFH-202 Exam Actual Questions
Note: Premium Questions for CCFH-202 were last updated On Dec. 07, 2024 (see below)
Where would an analyst find information about shells spawned by root, Kernel Module loads, and wget/curl usage?
The Linux Sensor report is where an analyst would find information about shells spawned by root, Kernel Module loads, and wget/curl usage. The Linux Sensor report is a pre-defined report that provides a summary view of selected activities on Linux hosts. It shows information such as process execution events, network connection events, file write events, etc. that occurred on Linux hosts within a specified time range. The Sensor Health report, the Sensor Policy Daily report, and the Mac Sensor report do not provide the same information.
Which of the following is a way to create event searches that run automatically and recur on a schedule that you set?
Scheduled Searches are a way to create event searches that run automatically and recur on a schedule that you set. You can use Scheduled Searches to monitor your environment for specific conditions or patterns, generate reports or alerts, or enrich your data with additional fields or tags. Workflows, Event Search, and Scheduled Reports are not ways to create event searches that run automatically and recur on a schedule.
What kind of activity does a User Search help you investigate?
User Search is an Investigate tool that helps you investigate a list of process activity executed by the specified user account. It shows information such as process name, command line, parent process name, parent command line, etc. for each process that was executed by the user account on any host in your environment. It does not show a history of Falcon UI logon activity, a count of failed user logon activity, or a list of DNS queries by the specified user account.
Lateral movement through a victim environment is an example of which stage of the Cyber Kill Chain?
Lateral movement through a victim environment is an example of the Command & Control stage of the Cyber Kill Chain. The Cyber Kill Chain is a model that describes the phases of a cyber attack, from reconnaissance to actions on objectives. The Command & Control stage is where the adversary establishes and maintains communication with the compromised systems and moves laterally to expand their access and control.
Which of the following does the Hunting and Investigation Guide contain?
The Hunting and Investigation guide contains example Event Search queries useful for threat hunting. These queries are based on common threat hunting use cases and scenarios, such as finding suspicious processes, network connections, registry activity, etc. The guide also explains how to customize and modify the queries to suit different needs and environments. The guide does not contain a list of all event types and their syntax, as that information is provided in the Events Data Dictionary. The guide also does not contain example Event Search queries useful for Falcon platform configuration, as that is not the focus of the guide.
- Select Question Types you want
- Set your Desired Pass Percentage
- Allocate Time (Hours : Minutes)
- Create Multiple Practice tests with Limited Questions
- Customer Support
Laticia
6 days agoDaniel
11 days agoHyun
13 days agoFlo
21 days agoNaomi
1 months agoChauncey
1 months agoCordelia
2 months agoNatalie
2 months agoWhitley
2 months agoLashaunda
2 months agoBronwyn
2 months agoGracie
3 months agoAileen
3 months agoZack
3 months agoElise
3 months agoEvangelina
3 months agoJesus
3 months agoIsreal
4 months agoHaydee
5 months agoLouisa
5 months agoIvette
6 months agoKathrine
6 months agoGiovanna
6 months agoProvidencia
6 months agoNorah
7 months agoReed
7 months ago