CrowdStrike CCFH-202 Online Practice Questions and Exam Preparation

CrowdStrike CCFH-202 Online Questions & Answers

• Question 61:

  The Falcon Detections page will attempt to decode Encoded PowerShell Command line parameters when which PowerShell Command line parameter is present?

  A. -Command
  B. -Hidden
  C. -e
  D. -nop
  A. -Command

  ---

  Explanation

  The Falcon Detections page will attempt to decode Encoded PowerShell Command line parameters when the -Command parameter is present. The -Command parameter allows PowerShell to execute a specified script block or string. If the script block or string is encoded using Base64 or other methods, the Falcon Detections page will try to decode it and show the original command. The -Hidden, -e, and -nop parameters are not related to encoding or decoding PowerShell commands.

  https://www.crowdstrike.com/blog/tech-center/decoding-powershell-commands-in-crowdstrike-falcon/

• Question 62:

  When performing a raw event search via the Events search page, what are Event Actions?

  A. Event Actions contains an audit information log of actions an analyst took in regards to a specific detection
  B. Event Actions contains the summary of actions taken by the Falcon sensor such as quarantining a file, prevent a process from executing or taking no actions and creating a detection only
  C. Event Actions are pivotable workflows including connecting to a host, pre-made event searches and pivots to other investigatory pages such as host search
  D. Event Actions is the field name that contains the event name defined in the Events Data Dictionary such as ProcessRollup, SyntheticProcessRollup, DNS request, etc
  C. Event Actions are pivotable workflows including connecting to a host, pre-made event searches and pivots to other investigatory pages such as host search

  ---

  Explanation

  When performing a raw event search via the Events search page, Event Actions are pivotable workflows that allow you to perform various tasks related to the event or the host. For example, you can connect to a host using Real Time

  Response, run pre-made event searches based on the event type or name, or pivot to other investigatory pages such as host search, hash search, etc. Event Actions do not contain audit information log, summary of actions taken by the

  Falcon sensor, or the event name defined in the Events Data Dictionary.

  https://www.crowdstrike.com/blog/tech-center/event-search-in-crowdstrike-falcon/

• Question 63:

  In the Powershell Hunt report, what does the "score" signify?

  A. Number of hosts that ran the PowerShell script
  B. How recently the PowerShell script executed
  C. Maliciousness score determined by NGAV
  D. A cumulative score of the various potential command line switches
  D. A cumulative score of the various potential command line switches

  ---

  Explanation

  In the Powershell Hunt report, the score signifies a cumulative score of the various potential command line switches that were used in the PowerShell script execution. The score is based on a weighted system that assigns different values to different switches based on their potential maliciousness or usefulness for threat hunting. For example, -EncodedCommand has a higher value than -NoProfile. The score does not signify the number of hosts that ran the PowerShell script, how recently the PowerShell script executed, or the maliciousness score determined by NGAV.

  https://www.crowdstrike.com/blog/tech-center/powershell-hunt-report-in-crowdstrike-falcon/

• Question 64:

  What kind of activity does a User Search help you investigate?

  A. A history of Falcon Ul logon activity
  B. A list of process activity executed by the specified user account
  C. A count of failed user logon activity
  D. A list of DNS queries by the specified user account
  B. A list of process activity executed by the specified user account

  ---

  Explanation

  User Search is an Investigate tool that helps you investigate a list of process activity executed by the specified user account. It shows information such as process name, command line, parent process name, parent command line, etc. for each process that was executed by the user account on any host in your environment. It does not show a history of Falcon UI logon activity, a count of failed user logon activity, or a list of DNS queries by the specified user account.

  https://www.crowdstrike.com/blog/tech-center/user-search-in-crowdstrike-falcon/

• Question 65:

  With Custom Alerts you are able to configure email alerts using predefined templates so you're notified about specific activity in your environment. Which of the following outlines the steps required to properly create a custom alert rule?

  A. Choose the template you would like to configure, setup how often you would like the alert to run, and then schedule the alert
  B. Choose the template you would like to configure, preview the search results, and then schedule the alert
  C. Create the query for the alert, setup the email template for the alert, and then set the schedule for the alert
  D. Create a new custom template, configure the email template, and then create the custom query for the alert
  B. Choose the template you would like to configure, preview the search results, and then schedule the alert

  ---

  Explanation

  These are the steps required to properly create a custom alert rule. Custom Alerts are a feature that allows you to configure email alerts using predefined templates so you're notified about specific activity in your environment. You can choose

  from various templates that cover different use cases, such as suspicious PowerShell activity, network connections to risky countries, etc. You can also preview the search results of the template before scheduling the alert. You do not need to

  create the query for the alert, setup the email template for the alert, or create a new custom template, as these are already provided by the predefined templates.

  https://www.crowdstrike.com/blog/tech-center/custom-alerts-in-crowdstrike-falcon/

• Question 66:

  What is the main purpose of the Mac Sensor report?

  A. To identify endpoints that are in Reduced Functionality Mode
  B. To provide a summary view of selected activities on Mac hosts
  C. To provide vulnerability assessment for Mac Operating Systems
  D. To provide a dashboard for Mac related detections
  B. To provide a summary view of selected activities on Mac hosts

  ---

  Explanation

  The Mac Sensor report is a pre-defined report that provides a summary view of selected activities on Mac hosts. It shows information such as process execution events, network connection events, file write events, etc. that occurred on Mac hosts within a specified time range. The Mac Sensor report does not identify endpoints that are in Reduced Functionality Mode, provide vulnerability assessment for Mac Operating Systems, or provide a dashboard for Mac related detections.

  https://www.crowdstrike.com/blog/tech-center/mac-sensor-report-in-crowdstrike-falcon/

• Question 67:

  Which of the following would be the correct field name to find the name of an event?

  A. Event_SimpleName
  B. Event_Simple_Name
  C. EVENT_SIMPLE_NAME
  D. event_simpleName
  A. Event_SimpleName

  ---

  Explanation

  Event_SimpleName is the correct field name to find the name of an event in Falcon Event Search. It is a field that shows the simplified name of each event type, such as ProcessRollup2, DnsRequest, or FileDelete. Event_Simple_Name,

  EVENT_SIMPLE_NAME, and event_simpleName are not valid field names for finding the name of an event.

  https://www.crowdstrike.com/blog/tech-center/event-search-in-crowdstrike-falcon/

• Question 68:

  Which Falcon documentation guide should you reference to hunt for anomalies related to scheduled tasks and other Windows related artifacts?

  A. Hunting and Investigation
  B. Customizable Dashboards
  C. MITRE-Based Falcon Detections Framework
  D. Events Data Dictionary
  A. Hunting and Investigation

  ---

  Explanation

  The Hunting and Investigation guide is the Falcon documentation guide that you should reference to hunt for anomalies related to scheduled tasks and other Windows related artifacts. The Hunting and Investigation guide provides sample hunting queries, select walkthroughs, and best practices for hunting with Falcon. It covers various topics such as process execution, network connections, registry activity, scheduled tasks, and more.

  https://falcon.crowdstrike.com/support/documentation/44/hunting-and-investigation

• Question 69:

  How would you find a list of executables running from the Recycle Bin across your environment?

  A. Executables running from Recycle Bin hunt report
  B. The only way to get this information is to copy the query from the Hunting Guide and search in Event Search
  C. There is no need for this report as it would always cause a detection in Falcon
  D. Processes can't run from the Recycle Bin
  A. Executables running from Recycle Bin hunt report

  ---

  Explanation

• Question 70:

  What Investigate tool would you use to allow an analyst to view all events for a specific host?

  A. Bulk Timeline
  B. Host Search
  C. Host Timeline
  D. Process Timeline
  C. Host Timeline

  ---

  Explanation

  The Host Timeline is the Investigate tool that you would use to allow an analyst to view all events for a specific host. The Host Timeline shows a graphical representation of all events that occurred on a host within a specified time range. It allows an analyst to zoom in and out, filter by event type or name, and drill down into event details. The Bulk Timeline, the Host Search, and the Process Timeline are not Investigate tools that you would use to view all events for a specific host.

  https://www.crowdstrike.com/blog/tech-center/host-timeline-in-crowdstrike-falcon/