CrowdStrike CCFH-202 Online Practice Questions and Exam Preparation

CrowdStrike CCFH-202 Online Questions & Answers

• Question 41:

  Which field should you reference in order to find the system time of a *FileWritten event?

  A. ContextTimeStamp_decimal
  B. FileTimeStamp_decimal
  C. ProcessStartTime_decimal
  D. timestamp
  A. ContextTimeStamp_decimal

  ---

  Explanation

  ContextTimeStamp_decimal is the field that shows the system time of the event that triggered the sensor to send data to the cloud. In this case, it would be the time when the file was written. FileTimeStamp_decimal is the field that shows the last modified time of the file, which may not be the same as the time when the file was written. ProcessStartTime_decimal is the field that shows the start time of the process that performed the file write operation, which may not be the same as the time when the file was written. Timestamp is the field that shows the time when the sensor data was received by the cloud, which may not be the same as the time when the file was written.

  https://www.crowdstrike.com/blog/ tech-center/understanding-timestamps-in-crowdstrike-falcon/

• Question 42:

  Which of the following Event Search queries would only find the DNS lookups to the domain: www randomdomain com?

  A. event_simpleName=DnsRequest DomainName=www randomdomain com
  B. event_simpleName=DnsRequest DomainName=randomdomain com ComputerName=localhost
  C. Dns=randomdomain com
  D. ComputerName=localhost DnsRequest "randomdomain com"
  A. event_simpleName=DnsRequest DomainName=www randomdomain com

  ---

  Explanation

  This Event Search query would only find the DNS lookups to the domain www randomdomain com, as it specifies the exact event type and domain name to match. The other queries would either find other events or domains that are not

  relevant to the question.

  https://www.crowdstrike.com/blog/tech-center/event-search-in-crowdstrike-falcon/

• Question 43:

  What topics are presented in the Hunting and Investigation Guide?

  A. Detailed tutorial on writing advanced queries such as sub-searches and joins
  B. Detailed summary of event names, descriptions, and some key data fields for hunting and investigation
  C. Sample hunting queries, select walkthroughs and best practices for hunting with Falcon
  D. Recommended platform configurations and prevention settings to ensure detections are generated for hunting leads
  C. Sample hunting queries, select walkthroughs and best practices for hunting with Falcon

  ---

  Explanation

  This is the correct answer for the same reason as above. The Hunting and Investigation guide provides sample hunting queries, select walkthroughs, and best practices for hunting with Falcon. It does not provide a detailed tutorial on writing advanced queries, a detailed summary of event names and descriptions, or recommended platform configurations and prevention settings.

  https://falcon.crowdstrike.com/support/documentation/44/hunting-and-investigation

• Question 44:

  What information is provided when using IP Search to look up an IP address?

  A. Both internal and external IPs
  B. Suspicious IP addresses
  C. External IPs only
  D. Internal IPs only
  C. External IPs only

  ---

  Explanation

  IP Search is an Investigate tool that allows you to look up information about external IPs only. It shows information such as geolocation, network connection events, detection history, etc. for each external IP address that has communicated

  with your hosts. It does not show information about internal IPs, suspicious IPs, or both internal and external IPs.

  https://www.crowdstrike.com/blog/tech-center/ip-search-in-crowdstrike-falcon/

• Question 45:

  Falcon detected the above file attempting to execute. At initial glance; what indicators can we use to provide an initial analysis of the file?

  

  A. VirusTotal, Hybrid Analysis, and Google pivot indicator lights enabled
  B. File name, path, Local and Global prevalence within the environment
  C. File path, hard disk volume number, and IOC Management action
  D. Local prevalence, IOC Management action, and Event Search
  B. File name, path, Local and Global prevalence within the environment

  ---

  Explanation

  The file name, path, Local and Global prevalence are indicators that can provide an initial analysis of the file without relying on external sources or tools. The file name can indicate the purpose or origin of the file, such as if it is a legitimate application or a malicious payload. The file path can indicate where the file was located or executed from, such as if it was in a temporary or system directory. The Local and Globalprevalence can indicate how common or rare the file is within the environment or across all Falcon customers, which can help assess the risk or impact of the file.

  https://www.crowdstrike.com/blog/tech-center/understanding-file-prevalence-in-crowdstrike-falcon/

• Question 46:

  Which tool allows a threat hunter to populate and colorize all known adversary techniques in a single view?

  A. MISP
  B. OWASP Threat Dragon
  C. OpenXDR
  D. MITRE ATTandCK Navigator
  D. MITRE ATTandCK Navigator

  ---

  Explanation

  MITRE ATTandCK Navigator is a tool that allows a threat hunter to populate and colorize all known adversary techniques in a single view. It is based on the MITRE ATTandCK framework, which is a knowledge base of adversary behaviors and

  tactics. The tool enables threat hunters to create custom matrices, layers, annotations, and filters to explore and model specific adversary techniques, with links to intelligence and case studies.

  https://mitre-attack.github.io/attack-navigator/

• Question 47:

  To find events that are outliers inside a network,___________is the best hunting method to use.

  A. time-based
  B. machine learning
  C. searching
  D. stacking
  D. stacking

  ---

  Explanation

  Stacking (Frequency Analysis) is the best hunting method to use to find events that are outliers inside a network. Stacking involves grouping events by a common attribute and counting their frequency, then sorting them by ascending or descending order to identify rare or common events. This can help find anomalies or deviations from normal behavior that could indicate malicious activity. Time-based searching, machine learning, and searching are not specific hunting methods to find outliers.

  https://www.crowdstrike.com/blog/tech-center/stacking-in-crowdstrike-falcon/

• Question 48:

  Suspicious RDP connections have been observed on a host within your environment. How do you utilize Event Search to show all connections on this specific host?

  A. event_simpleName=UserIdentity LogonType_decimal=10 | table timestamp ComputerName UserName UserPrincipal LogonServer
  B. table timestamp ComputerName UserName UserPrincipal LogonServer
  C. UserIdentity=LogonType_decimal=10 | table timestamp UserPrincipal LogonServer
  D. aid=[my-aid] event_simpleName=UserIdentity LogonType_decimal=10 | table timestamp ComputerName UserName UserPrincipal LogonServer
  D. aid=[my-aid] event_simpleName=UserIdentity LogonType_decimal=10 | table timestamp ComputerName UserName UserPrincipal LogonServer

  ---

  Explanation

• Question 49:

  You initiate a search with the following query: event_simpleName=UserLogon | table _time ComputerName UserName What results will display?

  A. Machine-readable event host time, host name, user name
  B. Human-readable event host time, host name, user name
  C. Machine-readable event cloud time, host name, user name
  D. Human-readable event cloud time, host name, user name
  B. Human-readable event host time, host name, user name

  ---

  Explanation

• Question 50:

  SPL (Splunk) eval statements can be used to convert Unix times (Epoch) into UTC readable time Which eval function is correct^

  A. now
  B. typeof
  C. strftime
  D. relative time
  C. strftime

  ---

  Explanation

  The strftime eval function is used to convert Unix times (Epoch) into UTC readable time. It takes two arguments: a Unix time field and a format string that specifies how to display the time. The now, typeof, and relative_time eval functions are

  not used to convert Unix times into UTC readable time.

  https://docs.splunk.com/Documentation/Splunk/8.2.3/SearchReference/CommonEvalFuncti ons