CrowdStrike CCFH-202 Online Practice Questions and Exam Preparation

CrowdStrike CCFH-202 Online Questions & Answers

• Question 51:

  Which document in the Support and Resources section will help you write queries by providing prebuilt examples that you could modify? One such example shows execution of common reconnaissance tools.

  A. Streaming API Reference
  B. Events Data Dictionary
  C. Query API Reference
  D. Hunting and Investigation
  D. Hunting and Investigation

  ---

  Explanation

• Question 52:

  Which of the following queries will return the parent processes responsible for launching badprogram exe?

  A. [search (ParentProcess) where name=badprogranrexe ] | table ParentProcessName _time
  B. event_simpleName=processrollup2 [search event_simpleName=processrollup2 FileName=badprogram.exe | rename ParentProcessld_decimal AS TargetProcessld_decimal | fields aid TargetProcessld_decimal] | stats count by FileName _time
  C. [search (ProcessList) where Name=badprogram.exe ] | search ParentProcessName | table ParentProcessName _time
  D. event_simpleName=processrollup2 [search event_simpleName=processrollup2 FileName=badprogram.exe | rename TargetProcessld_decimal AS ParentProcessld_decimal | fields aid TargetProcessld_decimal] | stats count by FileName _time
  D. event_simpleName=processrollup2 [search event_simpleName=processrollup2 FileName=badprogram.exe | rename TargetProcessld_decimal AS ParentProcessld_decimal | fields aid TargetProcessld_decimal] | stats count by FileName _time

  ---

  Explanation

  This query will return the parent processes responsible for launching badprogram.exe by using a subsearch to find the processrollup2 events where FileName is badprogram.exe, then renaming the TargetProcessld_decimal field to ParentProcessld_decimal and using it as a filter for the main search, then using stats to count the occurrences of each FileName by _time. The other queries will either not return the parent processes or use incorrect field names or syntax.

  https://www.crowdstrike.com/blog/tech-center/process-rollup-in-crowdstrike-falcon/

• Question 53:

  A benefit of using a threat hunting framework is that it:

  A. Automatically generates incident reports
  B. Eliminates false positives
  C. Provides high fidelity threat actor attribution
  D. Provides actionable, repeatable steps to conduct threat hunting
  D. Provides actionable, repeatable steps to conduct threat hunting

  ---

  Explanation

  A threat hunting framework is a methodology that guides threat hunters in planning, executing, and improving their threat hunting activities. A benefit of using a threat hunting framework is that it provides actionable, repeatable steps to

  conduct threat hunting in a consistent and efficient manner. A threat hunting framework does not automatically generate incident reports, eliminate false positives, or provide high fidelity threat actor attribution, as these are dependent on other

  factors such as data sources, tools, and analysis skills.

  https://www.crowdstrike.com/blog/tech-center/threat-hunting-framework/

• Question 54:

  You have found a hash-based indicator of compromise (IOC) in an intelligence report and want to determine if the program has run in your environment. Which search would provide all of the process executions over the timeframe specified?

  A. Bulk Host Audit
  B. IOC Search
  C. Process Search
  D. Hash Search
  D. Hash Search

  ---

  Explanation

• Question 55:

  Your environment has several PowerShell scripts running that are Base64 encoded. Which of the following areas of Falcon will show you the decoded PowerShell commands?

  A. PowerShell Encoded Commands report
  B. PowerShell Hunt report
  C. Event Search for event_simpleName=processrollup2 FileName=powershell.exe
  D. Command Line view of a Detection
  D. Command Line view of a Detection

  ---

  Explanation

• Question 56:

  What do you click to jump to a Process Timeline from many pages in Falcon, such as a Hash Search?

  A. PID
  B. Process ID or Parent Process ID
  C. CID
  D. Process Timeline Link
  D. Process Timeline Link

  ---

  Explanation

  The Process Timeline Link is what you click to jump to a Process Timeline from many pages in Falcon, such as a Hash Search. The Process Timeline Link is an icon that looks like three horizontal bars with dots on them. It appears next to

  each process name or ID on various pages in Falcon, such as Hash Search results, Detection details, Event Search results, etc. Clicking on it will open a new tab with the Process Timeline for that process. The PID, the Process ID or Parent

  Process ID, and the CID are not what you click to jump to a Process Timeline.

  https://www.crowdstrike.com/blog/tech-center/process-timeline-in-crowdstrike-falcon/

• Question 57:

  In the MITRE ATTandCK Framework (version 11 -the newest version released in April 2022), which of the following pair of tactics is not in the Enterprise: Windows matrix?

  A. Persistence and Execution
  B. Impact and Collection
  C. Privilege Escalation and Initial Access
  D. Reconnaissance and Resource Development
  D. Reconnaissance and Resource Development

  ---

  Explanation

  Reconnaissance and Resource Development are two tactics that are not in the Enterprise: Windows matrix of the MITRE ATTandCK Framework (version 11). These two tactics are part of the PRE-ATTandCK matrix, which covers the actions that

  adversaries take before compromising a target. The Enterprise: Windows matrix covers the actions that adversaries take after gaining initial access to a Windows system. Persistence, Execution, Impact, Collection, Privilege Escalation, and

  Initial Access are all tactics that are in the Enterprise: Windows matrix.

  https://attack.mitre.org/matrices/enterprise/windows/

• Question 58:

  When searching for all events related to a specfiic process which field(s) should be selected in a query from the Event Actions drop down menu?

  A. ContextProcessId_decimal
  B. timestamp
  C. Both TargetProcessId_decimal and ContextProcessId_decimal
  D. TargetProcessId_decimal
  C. Both TargetProcessId_decimal and ContextProcessId_decimal

  ---

  Explanation

• Question 59:

  Which structured analytic technique contrasts different hypotheses to determine which is the best leading (prioritized) hypothesis?

  A. Model hunting framework
  B. Competitive analysis
  C. Analysis of competing hypotheses
  D. Key assumptions check
  C. Analysis of competing hypotheses

  ---

  Explanation

  Analysis of competing hypotheses is a structured analytic technique that contrasts different hypotheses to determine which is the best leading (prioritized) hypothesis. It involves listing all the possible hypotheses, identifying the evidence and

  assumptions for each hypothesis, evaluating the consistency and reliability of the evidence and assumptions, and rating the likelihood of each hypothesis based on the evidence and assumptions.

  https://www.crowdstrike.com/blog/tech-center/analysis-of-competing-hypotheses/

• Question 60:

  Lateral movement through a victim environment is an example of which stage of the Cyber Kill Chain?

  A. Command and Control
  B. Actions on Objectives
  C. Exploitation
  D. Delivery
  A. Command and Control

  ---

  Explanation

  Lateral movement through a victim environment is an example of the Command and Control stage of the Cyber Kill Chain. The Cyber Kill Chain is a model that describes the phases of a cyber attack, from reconnaissance to actions on

  objectives. The Command and Control stage is where the adversary establishes and maintains communication with the compromised systems and moves laterally to expand their access and control.

  https://www.crowdstrike.com/blog/tech-center/cyber-kill-chain/