CrowdStrike CCFH-202 Online Practice Questions and Exam Preparation

CrowdStrike CCFH-202 Online Questions & Answers

• Question 81:

  Which information is returned after querying a hash on the Hash Search page?

  A. VirusTotal Score
  B. First Seen Date
  C. A Fuzzy Hash
  D. Hash Prevalence
  B. First Seen Date

  ---

  Explanation

• Question 82:

  While you're reviewing Unresolved Detections in the Host Search page, you notice the User Name column contains "hostnameS " What does this User Name indicate?

  A. The User Name is a System User
  B. The User Name is not relevant for the dashboard
  C. There is no User Name associated with the event
  D. The Falcon sensor could not determine the User Name
  C. There is no User Name associated with the event

  ---

  Explanation

  When you see "hostnameS" in the User Name column in the Host Search page, it means that there is no User Name associated with the event. This can happen when the event is related to a system process or service that does not have a user context. It does not mean that the User Name is a System User, that the User Name is not relevant for the dashboard, or that the Falcon sensor could not determine the User Name.

  https://www.crowdstrike.com/blog/techcenter/host-search-in-crowdstrike-falcon/

• Question 83:

  Which of the following is the proper method to quantify search results, enabling a hunter to quickly sort and identify outliers?

  A. Using the "| stats count by" command at the end of a search string in Event Search
  B. Using the "|stats count" command at the end of a search string in Event Search
  C. Using the "|eval" command at the end of a search string in Event Search
  D. Exporting Event Search results to a spreadsheet and aggregating the results
  A. Using the "| stats count by" command at the end of a search string in Event Search

  ---

  Explanation

  This is the proper method to quantify search results, enabling a hunter to quickly sort and identify outliers. The stats command is used to calculate summary statistics on the results of a search or subsearch, such as count, sum, average, etc. The count by option is used to count the number of events for each distinct value of a field or fields anddisplay them in a table. This can help find rare or common values that could indicate anomalies or deviations from normal behavior.

  https://docs.splunk.com/Documentation/Splunk/8.2.3/SearchReference/Stats

• Question 84:

  Which event field contains the Falcon generated ID for a process?

  A. event_simpleName
  B. TargetProcessId-decimal
  C. ProcessRollup2
  D. Process_Id_decimal
  B. TargetProcessId-decimal

  ---

  Explanation

• Question 85:

  Which field in a DNS Request event points to the responsible process?

  A. ContextProcessld_readable
  B. TargetProcessld_decimal
  C. ContextProcessld_decimal
  D. ParentProcessId_decimal
  A. ContextProcessld_readable

  ---

  Explanation

  The ContextProcessld_readable field in a DNS Request event points to the responsible process. The ContextProcessld_readable field is the readable representation of the process identifier for the process that initiated the DNS request. It can be used to identify which process was communicating with a specific domain or IP address. The TargetProcessld_decimal, ContextProcessld_decimal, and ParentProcessId_decimal fields do not point to the responsible process.

  https://falcon.crowdstrike.com/support/documentation/44/events-data-dictionary

• Question 86:

  When exporting the results of the following event search, what data is saved in the exported file (assuming Verbose Mode)? event_simpleName=*Written | stats count by ComputerName

  A. The text of the query
  B. The results of the Statistics tab
  C. No data Results can only be exported when the "table" command is used
  D. All events in the Events tab
  B. The results of the Statistics tab

  ---

  Explanation

  When exporting the results of an event search, the data that is saved in the exported file depends on the mode and the tab that is selected. In this case, the mode is Verbose and the tab is Statistics, as indicated by the stats command.

  Therefore, the data that is saved in the exported file is the results of the Statistics tab, which shows the count ofevents by ComputerName. The text of the query, all events in the Events tab, and no data are not correct answers.

  https://docs.splunk.com/Documentation/Splunk/8.2.3/Search/Exportsearchresults

• Question 87:

  Which of the following does the Hunting and Investigation Guide contain?

  A. A list of all event types and their syntax
  B. A list of all event types specifically used for hunting and their syntax
  C. Example Event Search queries useful for threat hunting
  D. Example Event Search queries useful for Falcon platform configuration
  C. Example Event Search queries useful for threat hunting

  ---

  Explanation

  The Hunting and Investigation guide contains example Event Search queries useful for threat hunting. These queries are based on common threat hunting use cases and scenarios, such as finding suspicious processes, network connections,

  registry activity, etc. The guide also explains how to customize and modify the queries to suit different needs and environments. The guide does not contain a list of all event types and their syntax, as that information is provided in the Events

  Data Dictionary. The guide also does not contain example Event Search queries useful for Falcon platform configuration, as that is not the focus of the guide.

  https://falcon.crowdstrike.com/support/documentation/44/hunting-and-investigation

• Question 88:

  What part of the Investigate module should you use when you want to write custom queries to analyze, explore, or hunt for suspicious or malicious activity in your environment?

  A. Host Search
  B. User Search
  C. Hash Execution Search
  D. Event Search
  D. Event Search

  ---

  Explanation