CrowdStrike CCFH-202 Online Practice Questions and Exam Preparation

CrowdStrike CCFH-202 Online Questions & Answers

• Question 31:

  Where would an analyst find information about shells spawned by root, Kernel Module loads, and wget/curl usage?

  A. Sensor Health report
  B. Linux Sensor report
  C. Sensor Policy Daily report
  D. Mac Sensor report
  B. Linux Sensor report

  ---

  Explanation

  The Linux Sensor report is where an analyst would find information about shells spawned by root, Kernel Module loads, and wget/curl usage. The Linux Sensor report is a pre-defined report that provides a summary view of selected activities

  on Linux hosts. It shows information such as process execution events, network connection events, file write events, etc. that occurred on Linux hosts within a specified time range. The Sensor Health report, the Sensor Policy Daily report, and

  the Mac Sensor report do not provide the same information.

  https://www.crowdstrike.com/blog/tech-center/linux-sensor-report-in-crowdstrike-falcon/

• Question 32:

  Which of the following is a way to create event searches that run automatically and recur on a schedule that you set?

  A. Workflows
  B. Event Search
  C. Scheduled Searches
  D. Scheduled Reports
  C. Scheduled Searches

  ---

  Explanation

  Scheduled Searches are a way to create event searches that run automatically and recur on a schedule that you set. You can use Scheduled Searches to monitor your environment for specific conditions or patterns, generate reports or alerts,

  or enrich your data with additional fields or tags. Workflows, Event Search, and Scheduled Reports are not ways to create event searches that run automatically and recur on a schedule.

  https://docs.splunk.com/Documentation/Splunk/8.2.3/Search/Scheduledsearches

• Question 33:

  Event Search queries in Falcon are powered by which query language?

  A. LINQ
  B. Xpath
  C. Xquery
  D. Splunk
  D. Splunk

  ---

  Explanation

• Question 34:

  What Search page would help a threat hunter differentiate testing, DevOPs, or general user activity from adversary behavior?

  A. Hash Search
  B. IP Search
  C. Domain Search
  D. User Search
  D. User Search

  ---

  Explanation

  User Search is a search page that allows a threat hunter to search for user activity across endpoints and correlate it with other events. This can help differentiate testing, DevOPs, or general user activity from adversary behavior by identifying

  anomalous or suspicious user actions, such as logging into multiple systems, running unusual commands, or accessing sensitive files.

  https://www.crowdstrike.com/blog/tech-center/user-search-in-crowdstrike-falcon/

• Question 35:

  When looking at a process tree, what do the nodes represent?

  A. The nodes only indicate severity
  B. The nodes represent process execution
  C. The nodes represent tactic and techniques used only
  D. The nodes do not give any information necessary for analysis but depict a picture for clarity
  B. The nodes represent process execution

  ---

  Explanation

• Question 36:

  During an investigation you find that files are being written to disk by a malicious process. While many are displayed in the detections as context items, you want to see all files written to your host by this process. What Splunk search would work for this scenario?

  A. event_simpleName=*written ComputerName=MyPC ContextProcessId_decimal=0123456789
  B. event_simpleName=*processrollup* ComputerName=MyPC TargetProcessId_decimal=0123456789
  C. event_simpleName=*written ComputerName=MyPC TargetProcessId_decimal=0123456789
  D. event_simpleName=*processrollup* ComputerName=MyPC ContextProcessId_decimal=0123456789
  A. event_simpleName=*written ComputerName=MyPC ContextProcessId_decimal=0123456789

  ---

  Explanation

• Question 37:

  What is the purpose of the rename command in this query? event_simpleName=ProcessRollup2 [search event_simpleName=ProcessRollup2 FileName=excel.exe | rename TargetProcessId_decimal AS ParentProcessId_decimal | fields aid ParentProcessId_decimal] | stats count by FileName CommandLine

  A. It runs a sub-search to locate all detections where excel.exe was blocked
  B. It renames a field to drive the main search in order to locate all children processes of excel.exe
  C. It joins all combinations of parent / children processes involving excel.exe
  D. It renames a field to drive the main search in order to locate all parent processes of excel.exe
  B. It renames a field to drive the main search in order to locate all children processes of excel.exe

  ---

  Explanation

• Question 38:

  When configuring a custom alert, how do you separate recipient email addresses if including more than one recipient?

  A. Colon ':'
  B. Comma ','
  C. Select emails via the dropdown user selector
  D. Semi-colon ';'
  B. Comma ','

  ---

  Explanation

• Question 39:

  The Events Data Dictionary found in the Falcon documentation is useful for writing hunting queries because:

  A. It provides pre-defined queries you can customize to meet your specific threat hunting needs
  B. It provides a list of all the detect names and descriptions found in the Falcon Cloud
  C. It provides a reference of information about the events found in the Investigate > Event Search page of the Falcon Console
  D. It provides a list of compatible splunk commands used to query event data
  C. It provides a reference of information about the events found in the Investigate > Event Search page of the Falcon Console

  ---

  Explanation

  This is the correct answer for the same reason as above. The Events Data Dictionary provides a reference of information about the events found in the Investigate > Event Search page of the Falcon Console, which is useful for writing hunting queries. It does not provide pre-defined queries, detect names and descriptions, or compatible splunk commands.

  https://falcon.crowdstrike.com/support/documentation/44/events-data-dictionary

• Question 40:

  While on the Statistics tab in Event Search you can click on results to perform a number of actions. If you select “Exclude from results” what happens?

  A. It will update the Search to remove that field name from results
  B. It will update the Search to remove results matching on thefi eld valid pair
  C. There is no Exclude form results option
  D. It will update the Search to remove that results matching the value
  D. It will update the Search to remove that results matching the value

  ---

  Explanation