CrowdStrike CCFH-202 Online Practice Questions and Exam Preparation

CrowdStrike CCFH-202 Online Questions & Answers

• Question 21:

  Which of the following process trees should raise the most suspicion that adversary activity may be present on a web server?

  A. SMSS.EXE >> WINLOGON.EXE >> USERINIT.EXE >> EXPLORER.EXE >> WORD.EXE
  B. WINLOGON.EXE >> USERINIT.EXE >> EXPLORER.EXE >> OUTLOOK.EXE >> CHROME.EXE
  C. WININIT.EXE >> SERVICES >> SVCHOST.EXE >> TASKENG.EXE >> POWERSHELL.EXE
  D. WININIT.EXE >> SERVICES >> SVCHOST.EXE >> W3WP.EXE >> CMD.EXE
  D. WININIT.EXE >> SERVICES >> SVCHOST.EXE >> W3WP.EXE >> CMD.EXE

  ---

  Explanation

• Question 22:

  When reviewing a DNS request in the Event Search, you're curious which process made the request. Which Event Action would be the quickest way to show you the process?

  A. Show Associated Event Data (from TargetProcessID_decimal)
  B. Show Parent Process
  C. Show Responsible Process Data
  D. Pivot - Host Search
  C. Show Responsible Process Data

  ---

  Explanation

• Question 23:

  What elements are required to properly execute a Process Timeline?

  A. Agent ID (AID) and Target Process ID
  B. Agent ID (AID) only
  C. Hostname and Local Process ID
  D. Target Process ID only
  A. Agent ID (AID) and Target Process ID

  ---

  Explanation

  The Agent ID (AID) and the Target Process ID are the elements that are required to properly execute a Process Timeline. The Agent ID (AID) is a unique identifier for each host that has a Falcon sensor installed. The Target Process ID is the decimal representation of the process identifier for the process that you want to investigate. These two elements are used to query the cloud for the events related to the process on the host. The Agent ID (AID) only, the Hostname and Local Process ID, and the Target Process ID only are not sufficient to execute a Process Timeline.

  https://www.crowdstrike.com/blog/tech-center/process-timeline-in-crowdstrike-falcon/

• Question 24:

  What type of attack would this process tree indicate?

  

  A. Brute Forcing Attack
  B. Man-in-the-middle Attack
  C. Phishing Attack
  D. Web Application Attack
  C. Phishing Attack

  ---

  Explanation

  This process tree indicates a phishing attack, as it shows a user opening an email attachment (outlook.exe) that launches a malicious macro (cmd.exe) that downloads and executes a payload (powershell.exe) that connects to a remote server (svchost.exe). A phishing attack is a type of social engineering attack that uses deceptive emails or messages to trick users into opening malicious attachments or links that can compromise their systems or credentials.

  https://www.crowdstrike.com/blog/tech-center/process-tree-in-crowdstrike-falcon/

• Question 25:

  An analyst has sorted all recent detections in the Falcon platform to identify the oldest in an effort to determine the possible first victim host What is this type of analysis called?

  A. Visualization of hosts
  B. Statistical analysis
  C. Temporal analysis
  D. Machine Learning
  C. Temporal analysis

  ---

  Explanation

  Temporal analysis is a type of analysis that focuses on the timing and sequence of events in order to identify patterns, trends, or anomalies. By sorting all recent detections in the Falcon platform to identify the oldest, an analyst can perform temporal analysis to determine the possible first victim host and trace back the origin of an attack.

  https://www.crowdstrike.com/blog/tech-center/temporal-analysis-in-crowdstrike-falcon/

• Question 26:

  Which event_simpleName has a field that contains the command line used to create a process?

  A. ProcessRollup2
  B. DNSRequest
  C. CommandHistory
  D. PeVersionInfo
  A. ProcessRollup2

  ---

  Explanation

• Question 27:

  Event Search data is recorded with which time zone?

  A. PST
  B. GMT
  C. EST
  D. UTC
  D. UTC

  ---

  Explanation

  Event Search data is recorded with UTC (Coordinated Universal Time) time zone. UTC is a standard time zone that is used as a reference point for other time zones. PST (Pacific Standard Time), GMT (Greenwich Mean Time), and EST (Eastern Standard Time) are not the time zones that Event Search data is recorded with.

  https://www.crowdstrike.com/blog/tech-center/understanding-timestamps-in-crowdstrike-falcon/

• Question 28:

  Your organization's next-gen firewall has detected evidence of DNS beaconing occurring from an internal source. The firewall provides you with the beaconing host's internal (private) IP address. In an IP search, which field would you leverage to identify the hostname based on this indicator?

  A. Destination IP
  B. Bulk Host Audit
  C. External IP
  D. Source IP
  D. Source IP

  ---

  Explanation

• Question 29:

  Which document provides information on best practices for writing Splunk-based hunting queries, predefined queries which may be customized to hunt for suspicious network connections, and predefined queries which may be customized to hunt for suspicious processes?

  A. Real Time Response and Network Containment
  B. Hunting and Investigation
  C. Events Data Dictionary
  D. Incident and Detection Monitoring
  B. Hunting and Investigation

  ---

  Explanation

  The Hunting and Investigation document provides information on best practices for writing Splunk-based hunting queries, predefined queries which may be customized to hunt for suspicious network connections, and predefined queries which may be customized to hunt for suspicious processes. As explained above, the Hunting and Investigation document is a guide that provides sample hunting queries, select walkthroughs, and best practices for hunting with Falcon. The other documents do not provide the same information.

  https://falcon.crowdstrike.com/support/documentation/44/hunting-and-investigation

• Question 30:

  What is the difference between a Host Search and a Host Timeline?

  A. Host Search is used for detection investigation and Host Timeline is used for proactive hunting
  B. A Host Search organizes the data in useful event categories like process executions and network connections, a Host Timeline provides an uncategorized view of recorded events in chronological order
  C. You access a Host Search from a detection to show you every recorded process event related to the detection and you can only populate the Host Timeline fields manually
  D. There is no difference. You just get to them different ways
  B. A Host Search organizes the data in useful event categories like process executions and network connections, a Host Timeline provides an uncategorized view of recorded events in chronological order

  ---

  Explanation

  This is the difference between a Host Search and a Host Timeline. A Host Search is an Investigate tool that allows you to view events by category, such as process executions, network connections, file writes, etc. A Host Timeline is an

  Investigate tool that allows you to view all events in chronological order, without any categorization. Both tools can be used for detection investigation and proactive hunting, depending on the use case and preference. You can access a Host

  Search from a detection or manually enter the host details. You can also populate the Host Timeline fields manually or from other pages in Falcon.

  https://www.crowdstrike.com/blog/tech-center/host-search-in-crowdstrike-falcon/ https://www.crowdstrike.com/blog/tech-center/host-timeline-in-crowdstrike-falcon/