CrowdStrike CCFH-202 Online Practice Questions and Exam Preparation

CrowdStrike CCFH-202 Online Questions & Answers

• Question 11:

  You need details about key data fields and sensor events which you may expect to find fromHosts running the Falcon sensor.Which documentation should you access?

  A. Events Data Dictionary
  B. Streaming API Event Dictionary
  C. Hunting and Investigation
  D. Event stream APIs
  A. Events Data Dictionary

  ---

  Explanation

  The Events Data Dictionary found in the Falcon documentation is useful for writing hunting queries because it provides a reference of information about the events found in the Investigate > Event Search page of the Falcon Console. The Events Data Dictionary describes each event type, field name, data type, description, and example value that can be used to query and analyze event data. The Streaming API Event Dictionary, Hunting and Investigation, and Event stream APIs are not documentation that provide details about key data fields and sensor events.

  https://falcon.crowdstrike.com/support/documentation/44/events-data-dictionary

• Question 12:

  Which of the following best describes the purpose of the Mac Sensor report?

  A. The Mac Sensor report displays a listing of all Mac hosts without a Falcon sensor installed
  B. The Mac Sensor report provides a detection focused view of known malicious activities occurring on Mac hosts, including machine-learning and indicator-based detections
  C. The Mac Sensor report displays a listing of all Mac hosts with a Falcon sensor installed
  D. The Mac Sensor report provides a comprehensive view of activities occurring on Mac hosts, including items of interest that may be hunting or investigation leads
  D. The Mac Sensor report provides a comprehensive view of activities occurring on Mac hosts, including items of interest that may be hunting or investigation leads

  ---

  Explanation

  This is the correct answer for the same reason as above. The Mac Sensor report provides a comprehensive view of activities occurring on Mac hosts, including items of interest that may be hunting or investigation leads. It does not display a listing of all Mac hosts with or without a Falcon sensor installed, nor does it provide a detection focused view of known malicious activities occurring on Mac hosts.

  https://www.crowdstrike.com/blog/tech-center/mac-sensor-reportin-crowdstrike-falcon/

• Question 13:

  The help desk is reporting an increase in calls related to user accounts being locked out over the last few days. You suspect that this could be an attack by an adversary against your organization. Select the best hunting hypothesis from the following:

  A. A zero-day vulnerability is being exploited on a Microsoft Exchange server
  B. A publicly available web application has been hacked and is causing the lockouts
  C. Users are locking their accounts out because they recently changed their passwords
  D. A password guessing attack is being executed against remote access mechanisms such as VPN
  D. A password guessing attack is being executed against remote access mechanisms such as VPN

  ---

  Explanation

  A hunting hypothesis is a statement that describes a possible malicious activity that can be tested with data and analysis. A good hunting hypothesis should be specific, testable, and relevant to the problem or goal. In this case, the best hunting hypothesis from the following is that a password guessing attack is being executed against remote access mechanisms such as VPN, as it explains the possible cause and method of the user account lockouts in a specific and testable way. A zero-day vulnerability on a Microsoft Exchange server is too vague and does not explain how it relates to the lockouts. A hacked web application is also too vague and does not specify how it causes the lockouts. Users locking their accounts out because they recently changed their passwords is not a malicious activity and does not account for the increase in calls.

  https://www.crowdstrike.com/blog/tech-center/threat-hunting-framework/

• Question 14:

  Which of the following is an example of a Falcon threat hunting lead?

  A. A routine threat hunt query showing process executions of single letter filename (e.g., a.exe) from temporary directories
  B. Security appliance logs showing potentially bad traffic to an unknown external IP address
  C. A help desk ticket for a user clicking on a link in an email causing their machine to become unresponsive and have high CPU usage
  D. An external report describing a unique 5 character file extension for ransomware encrypted files
  A. A routine threat hunt query showing process executions of single letter filename (e.g., a.exe) from temporary directories

  ---

  Explanation

  A Falcon threat hunting lead is a piece of information that can be used to initiate or guide a threat hunting activity within the Falcon platform. A routine threat hunt query showing process executions of single letter filename (e.g., a.exe) from temporary directories is an example of a Falcon threat hunting lead, as it can indicate potentialmalicious activity that can be further investigated using Falcon data and features. Security appliance logs, help desk tickets, and external reports are not examples of Falcon threat hunting leads, as they are not directly related to the Falcon platform or data.

  https://www.crowdstrike.com/blog/tech-center/threat-hunting-leads-in-crowdstrike-falcon/

• Question 15:

  What kind of IP addresses are found using an IP Search?

  A. Source only
  B. IPV6 connections only
  C. Destination only
  D. Destination, Source, and External IP (AIP)
  D. Destination, Source, and External IP (AIP)

  ---

  Explanation

• Question 16:

  In which of the following stages of the Cyber Kill Chain does the actor not interact with the victim endpoint(s)?

  A. Exploitation
  B. Weaponization
  C. Command and control
  D. Installation
  B. Weaponization

  ---

  Explanation

  Weaponization is the stage of the Cyber Kill Chain where the actor does not interact with the victim endpoint(s). Weaponization is where the actor prepares or packages the exploit or payload that will be used to compromise the target. This stage does not involve any communication or interaction with the victim endpoint(s), as it is done by the actor before delivering the weaponized content. Exploitation, Command and Control, and Installation are all stages where the actor interacts with the victim endpoint(s), either by executing code, establishing communication, or installing malware.

  https://www.crowdstrike.com/blog/tech-center/cyber-kill-chain/

• Question 17:

  Which pre-defined reports offer information surrounding activities that typically indicate suspicious activity occurring on a system?

  A. Scheduled searches
  B. Hunt reports
  C. Sensor reports
  D. Timeline reports
  B. Hunt reports

  ---

  Explanation

  Hunt reports are pre-defined reports that offer information surrounding activities that typically indicate suspicious activity occurring on a system. They are based on common threat hunting use cases and queries, and they provide visualizations and summaries of the results. Hunt reports can help threat hunters quickly identify and investigate potential threats in their environment.

  https://www.crowdstrike.com/blog/tech-center/hunt-reports-in-crowdstrikefalcon/

• Question 18:

  Where in the Falcon console do you find hunting reports?

  A. Investigate module
  B. Endpoint security module
  C. Support and resources module
  D. Discover module
  A. Investigate module

  ---

  Explanation

• Question 19:

  Which of the following is a suspicious process behavior?

  A. PowerShell running an execution policy of RemoteSigned
  B. An Internet browser (eg, Internet Explorer) performing multiple DNS requests
  C. PowerShell launching a PowerShell script
  D. Non-network processes (eg, notepad exe) making an outbound network connection
  D. Non-network processes (eg, notepad exe) making an outbound network connection

  ---

  Explanation

  Non-network processes are processes that are not expected to communicate over the network, such as notepad.exe. If they make an outbound network connection, it could indicate that they are compromised or maliciously used by an

  adversary. PowerShell running an execution policy of RemoteSigned is a default setting that allows local scripts to run without digital signatures. An Internet browser performing multiple DNS requests is a normal behavior for web browsing.

  PowerShell launching a PowerShell script is also a common behavior for legitimate tasks.

  https://www.crowdstrike.com/blog/tech-center/detect-malicious-use-of-non-network-processes/

• Question 20:

  How do you rename fields while using transforming commands such as table, chart, and stats?

  A. By renaming the fields with the "rename" command after the transforming command e.g. "stats count by ComputerName | rename count AS total_count"
  B. You cannot rename fields as it would affect sub-queries and statistical analysis
  C. By using the "renamed" keyword after the field name eg "stats count renamed totalcount by ComputerName"
  D. By specifying the desired name after the field name eg "stats count totalcount by ComputerName"
  A. By renaming the fields with the "rename" command after the transforming command e.g. "stats count by ComputerName | rename count AS total_count"

  ---

  Explanation

  The rename command is used to rename fields while using transforming commands such as table, chart, and stats. It can be used after the transforming command and specify the old and new field names with the AS keyword. You can

  rename fields as it would not affect sub-queries and statistical analysis, as long as you use the correct field names in your queries. The renamed keyword and the desired name after the field name are not valid ways to rename fields.

  https://docs.splunk.com/Documentation/Splunk/8.2.3/SearchReference/Rename