CrowdStrike CCFH-202 Online Practice Questions and Exam Preparation

CrowdStrike CCFH-202 Online Questions & Answers

• Question 71:

  What document in the Support and Resources section will provide you with a breakdown of event types and related fields?

  A. Query API Reference
  B. Getting Started Guide
  C. Streaming API Reference
  D. Events Data Dictionary
  D. Events Data Dictionary

  ---

  Explanation

• Question 72:

  To best determine the root cause of an enterprise wide infection you would:

  A. Examine a list of processes by hash to determine the latest execution time and last infected machine.
  B. Perform frequency analysis to identify outlier processes that should not be running in your environment.
  C. Examine a list of process executions with a specfiic hash to determine the earliest execution time.
  D. Examine a list of outbound network connections on non-standard ports to identify suspicious processes.
  C. Examine a list of process executions with a specfiic hash to determine the earliest execution time.

  ---

  Explanation

• Question 73:

  When looking at a detection's details, you can pivot to an Event Search. What is the purpose of this Event Search?

  A. It takes you to the event data related to the detection and provides you with a number of Event Actions
  B. It provides chronological list of all the event data for the host
  C. It allows the analyst to view the full detection details
  D. It takes you to the Event Search and shows a +/-10-minute window of events
  A. It takes you to the event data related to the detection and provides you with a number of Event Actions

  ---

  Explanation

• Question 74:

  Which of the following is TRUE about a Hash Search?

  A. Wildcard searches are not permitted with the Hash Search
  B. The Hash Search provides Process Execution History
  C. The Hash Search is available on Linux
  D. Module Load History is not presented in a Hash Search
  B. The Hash Search provides Process Execution History

  ---

  Explanation

  The Hash Search is an Investigate tool that allows you to search for a file hash and view its process execution history across all hosts in your environment. It shows information such as process name, command line, parent process name, parent command line, etc. for each execution of the file hash. Wildcard searches are permitted with the Hash Search, as long as they are at least four characters long. The Hash Search is available on Linux, as well as Windows and Mac OS

  X. Module Load History is presented in aHash Search, along with other information such as File Write History and Detection History.

  https://www.crowdstrike.com/blog/tech-center/hash-search-in-crowdstrike-falcon/

• Question 75:

  You would like to search for ANY process execution that used a file stored in the Recycle Bin on a Windows host. Select the option to complete the following EAM query.

  

  A. *$Recycle Bin^
  B. *$Recycle Bin*
  C. ^$Recycle Bin*
  D. ^$Recycle.Bin%^
  B. *$Recycle Bin*

  ---

  Explanation

  This option is the correct one to complete the following EAM query:

  event_simpleName=ProcessRollup2 FileName=$Recycle Bin This query would search for any process execution that used a file stored in the Recycle Bin on a Windows host, as the asterisk (*) is a wildcard character that matches any

  number of characters before or after the specified string. The other options are not correct, as they use different wildcard characters that do not match the desired pattern.

  https://docs.splunk.com/Documentation/Splunk/8.2.3/

  Search/Wildcards

• Question 76:

  Which threat framework allows a threat hunter to explore and model specific adversary tactics and techniques, with links to intelligence and case studies?

  A. MITRE ATTandCK
  B. Lockheed Martin Cyber Kill Chain
  C. Director of National Intelligence Cyber Threat Framework
  D. NIST 800-171 Cyber Threat Framework
  A. MITRE ATTandCK

  ---

  Explanation

  MITRE ATTandCK is a threat framework that allows a threat hunter to explore and model specific adversary tactics and techniques, with links to intelligence and case studies. It is a knowledge base of adversary behaviors and tactics that covers

  various platforms, domains, and scenarios. It provides a common language and structure for threat hunters to understand and analyze threats, as well as to share findings and recommendations.

  https://attack.mitre.org/

• Question 77:

  Which of the following is a recommended technique to find unique outliers among a set of data in the Falcon Event Search?

  A. Hunt-and-Peck Search Methodology
  B. Stacking (Frequency Analysis)
  C. Time-based Searching
  D. Machine Learning
  B. Stacking (Frequency Analysis)

  ---

  Explanation

  Stacking (Frequency Analysis) is a recommended technique to find unique outliers among a set of data in the Falcon Event Search. As explained above, stacking involves grouping events by a common attribute and counting their frequency, then sorting them by ascending or descending order to identify rare or common events. This can help find anomalies or deviations from normal behavior that could indicate malicious activity. Hunt-and-Peck Search Methodology, Time-based Searching, and Machine Learning are not specific techniques to find unique outliers among a set of data.

  https://www.crowdstrike.com/blog/tech-center/stacking-in-crowdstrike-falcon/

• Question 78:

  Which SPL (Splunk) field name can be used to automatically convert Unix times (Epoch) to UTC readable time within the Flacon Event Search?

  A. utc_time
  B. conv_time
  C. _time
  D. time
  C. _time

  ---

  Explanation

  _time is the SPL (Splunk) field name that can be used to automatically convert Unix times (Epoch) to UTC readable time within the Falcon Event Search. It is a default field that shows the timestamp of each event in a human-readable format.

  utc_time, conv_time, and time are not valid SPL field names for converting Unix times to UTC readable time.

  https://www.crowdstrike.com/blog/tech-center/understanding-timestamps-in-crowdstrike-falcon/

• Question 79:

  What information is shown in Host Search?

  A. Quarantined Files
  B. Prevention Policies
  C. Intel Reports
  D. Processes and Services
  D. Processes and Services

  ---

  Explanation

  Processes and Services is one of the information that is shown in Host Search. Host Search is an Investigate tool that allows you to view events by category, such as process executions, network connections, file writes, etc. Processes and Services is one of the categories that shows information such as process name, command line, parent process name, parent command line, etc. for each process execution event on a host. Quarantined Files, Prevention Policies, and Intel Reports are not shown in Host Search.

  https://www.crowdstrike.com/blog/tech-center/host-search-in-crowdstrike-falcon/

• Question 80:

  You are reviewing a list of domains recently banned by your organization's acceptable use policy. In particular, you are looking for the number of hosts that have visited each domain. Which tool should you use in Falcon?

  A. Create a custom alert for each domain
  B. Allowed Domain Summary Report
  C. Bulk Domain Search
  D. IP Addresses Search
  C. Bulk Domain Search

  ---

  Explanation

  Bulk Domain Search is the tool that you should use in Falcon to review a list of domains recently banned by your organization's acceptable use policy and look for the number of hosts that have visited each domain. Bulk Domain Search is an Investigate tool that allows you to search for multiple domains at once and view their network connection events across all hosts in your environment. It shows information such as domain name, number of hosts visited, number of detections generated, etc. for each domain. Create a custom alert for each domain, Allowed Domain Summary Report, and IP Addresses Search are not tools that you should use for this purpose.

  https://www.crowdstrike.com/blog/techcenter/bulk-domain-search-in-crowdstrike-falcon/