CrowdStrike CCFH-202 Online Practice Questions and Exam Preparation

CrowdStrike CCFH-202 Online Questions & Answers

• Question 1:

  You want to produce a list of all event occurrences along with selected fields such as the full path, time, username etc.Which command would be the appropriate choice?

  A. fields
  B. distinctcount
  C. table
  D. values
  C. table

  ---

  Explanation

  The table command is used to produce a list of all event occurrences along with selected fields such as the full path, time, username etc. It takes one or more field names as arguments and displays them in a tabular format. The fields command is used to keep or remove fields from search results, not to display them in a list. The distinct_count command is used to count the number of distinct values of a field, not to display them in a list. The values command is used to display a list of unique values of a field within each group, not to display all event occurrences.

  https://docs.splunk.com/Documentation/Splunk/8.2.3/SearchReference/Table

• Question 2:

  What command will eliminate duplicates from a query?

  A. rmdup
  B. stats dc ()
  C. dedup
  D. accum
  C. dedup

  ---

  Explanation

• Question 3:

  In the Powershell Hunt report, what does the filtering condition of commandLine! ="*badstring* " do?

  A. Prevents command lines containing "badstring" from being displayed
  B. Displays only the command lines containing "badstring"
  C. Highlights "badstring" in all command lines in the output
  D. Highlights only the command lines containing "badstring"
  A. Prevents command lines containing "badstring" from being displayed

  ---

  Explanation

  In the Powershell Hunt report, the filtering condition of commandLine! ="badstring " prevents command lines containing "badstring" from being displayed. The ! operator isused to negate or exclude a condition from the search results. The *

  operator is used as a wildcard to match any number of characters before or after the specified string. Therefore, commandLine! ="badstring " means to filter out any command line that has "badstring" anywhere in it. The other options are not

  correct, as they do not describe what the filtering condition does.

  https://docs.splunk.com/Documentation/Splunk/8.2.3/Search/Wildcards

• Question 4:

  What information is provided from the MITRE ATTandCK framework in a detection's Execution Details?

  A. Grouping Tag
  B. Command Line
  C. Technique ID
  D. Triggering Indicator
  C. Technique ID

  ---

  Explanation

  Technique ID is the information that is provided from the MITRE ATTandCK framework in a detection's Execution Details. Technique ID is a unique identifier for each technique in the MITRE ATTandCK framework, such as T1059 for Command

  and Scripting Interpreter or T1566 for Phishing. Technique ID helps to map a detection to a specific adversary behavior and tactic. Grouping Tag, Command Line, and Triggering Indicator are notinformation that is provided from the MITRE

  ATTandCK framework in a detection's Execution Details.

  https://www.crowdstrike.com/blog/tech-center/mitre-attck-in-crowdstrike-falcon/

• Question 5:

  To view Files Written to Removable Media within a specified timeframe on a host within the Host Search page, expand and refer to the _______dashboard panel.

  A. Command Line and Admin Tools
  B. Processes and Services
  C. Registry, Tasks, and Firewall
  D. Suspicious File Activity
  D. Suspicious File Activity

  ---

  Explanation

  To view Files Written to Removable Media within a specified timeframe on a host within the Host Search page, you need to expand and refer to the Suspicious File Activity dashboard panel. The Suspicious File Activity dashboard panel shows

  information such as files written to removable media, files written to system directories by non-system processes, files written to startup folders, etc. The other dashboard panels do not show files written to removable media.

  https://www.crowdstrike.com/blog/tech-center/host-search-in-crowdstrike-falcon/

• Question 6:

  Which of the following is an example of actor actions during the RECONNAISSANCE phase of the Cyber Kill Chain?

  A. Installing a backdoor on the victim endpoint
  B. Discovering internet-facing servers
  C. Emailing the intended victim with a malware attachment
  D. Loading a malicious payload into a common DLL
  B. Discovering internet-facing servers

  ---

  Explanation

  Discovering internet-facing servers is an example of actor actions during the RECONNAISSANCE phase of the Cyber Kill Chain. The RECONNAISSANCE phase is where the adversary researches and identifies targets, vulnerabilities, and

  attack vectors. Discovering internet-facing servers is a way for the adversary to find potential entry points or weaknesses in the target network.

  https://www.crowdstrike.com/blog/tech-center/cyber-kill-chain/

• Question 7:

  The MITRE ATTandCK Framework includes all of the following matrices, except:

  A. Blackberry
  B. Containers
  C. Android
  D. iOS
  A. Blackberry

  ---

  Explanation

• Question 8:

  The Process Timeline Events Details table will populate the Parent Process ID and the Parent File columns when the cloudable Event data contains which event field?

  A. ContextProcessld_decimal
  B. RawProcessld_decimal
  C. ParentProcessld_decimal
  D. RpcProcessld_decimal
  C. ParentProcessld_decimal

  ---

  Explanation

  The ParentProcessld_decimal event field is what the Process Timeline Events Details table will populate the Parent Process ID and the Parent File columns with when the cloudable Event data contains it. The ParentProcessld_decimal event field is the decimal representation of the process identifier for the parent process of the target process. It can be used to trace the process ancestry and identify potential malicious activity. The ContextProcessld_decimal, RawProcessld_decimal, and RpcProcessld_decimal event fields are not used to populate the Parent Process ID and the Parent File columns.

  https://falcon.crowdstrike.com/support/documentation/44/events-data-dictionary

• Question 9:

  Adversaries commonly execute discovery commands such as net.exe, ipcofing.exe, and whoami.exe. Rather than query for each of these commands individually, you would like to use a single query with all of them. What Splunk operator is needed to complete the following query?

  

  A. OR
  B. IN
  C. NOT
  D. AND
  A. OR

  ---

  Explanation

  The OR operator is needed to complete the following query, as it allows to search for events that match any of the specified values. The query would look like this:

  event_simpleName=ProcessRollup2 FileName=net.exe OR FileName=ipconfig.exe OR FileName=whoami.exe

  The OR operator is used to combine multiple search terms or expressions and return events that match at least one of them. The IN, NOT, and AND operators are not suitable for this query, as they have different functions and meanings.

  https://docs.splunk.com/Documentation/Splunk/8.2.3/SearchReference/Searchsyntaxbasic s

• Question 10:

  Which report would you use to find when a specific user last reset their password?

  A. Falcon UI Audit Trail
  B. Remote Access Graph Visibility Report
  C. User Timeline
  D. Logon Activities Visibility Report
  C. User Timeline

  ---

  Explanation