CrowdStrike CCFH-202 Exam Practice Test Instant Access

Question 1

Which of the following is TRUE about a Hash Search?

AWildcard searches are not permitted with the Hash Search

BThe Hash Search provides Process Execution History

CThe Hash Search is available on Linux

DModule Load History is not presented in a Hash Search

Answer : B

The Hash Search is an Investigate tool that allows you to search for a file hash and view its process execution history across all hosts in your environment. It shows information such as process name, command line, parent process name, parent command line, etc. for each execution of the file hash. Wildcard searches are permitted with the Hash Search, as long as they are at least four characters long. The Hash Search is available on Linux, as well as Windows and Mac OS X. Module Load History is presented in a Hash Search, along with other information such as File Write History and Detection History.

Question 2

While you're reviewing Unresolved Detections in the Host Search page, you notice the User Name column contains "hostnameS " What does this User Name indicate?

AThe User Name is a System User

BThe User Name is not relevant for the dashboard

CThere is no User Name associated with the event

DThe Falcon sensor could not determine the User Name

Answer : C

When you see ''hostnameS'' in the User Name column in the Host Search page, it means that there is no User Name associated with the event. This can happen when the event is related to a system process or service that does not have a user context. It does not mean that the User Name is a System User, that the User Name is not relevant for the dashboard, or that the Falcon sensor could not determine the User Name.

Question 3

Where would an analyst find information about shells spawned by root, Kernel Module loads, and wget/curl usage?

ASensor Health report

BLinux Sensor report

CSensor Policy Daily report

DMac Sensor report

Answer : B

The Linux Sensor report is where an analyst would find information about shells spawned by root, Kernel Module loads, and wget/curl usage. The Linux Sensor report is a pre-defined report that provides a summary view of selected activities on Linux hosts. It shows information such as process execution events, network connection events, file write events, etc. that occurred on Linux hosts within a specified time range. The Sensor Health report, the Sensor Policy Daily report, and the Mac Sensor report do not provide the same information.

Question 4

Which of the following does the Hunting and Investigation Guide contain?

AA list of all event types and their syntax

BA list of all event types specifically used for hunting and their syntax

CExample Event Search queries useful for threat hunting

DExample Event Search queries useful for Falcon platform configuration

Answer : C

The Hunting and Investigation guide contains example Event Search queries useful for threat hunting. These queries are based on common threat hunting use cases and scenarios, such as finding suspicious processes, network connections, registry activity, etc. The guide also explains how to customize and modify the queries to suit different needs and environments. The guide does not contain a list of all event types and their syntax, as that information is provided in the Events Data Dictionary. The guide also does not contain example Event Search queries useful for Falcon platform configuration, as that is not the focus of the guide.

Question 5

The Events Data Dictionary found in the Falcon documentation is useful for writing hunting queries because:

AIt provides pre-defined queries you can customize to meet your specific threat hunting needs

BIt provides a list of all the detect names and descriptions found in the Falcon Cloud

CIt provides a reference of information about the events found in the Investigate > Event Search page of the Falcon Console

DIt provides a list of compatible splunk commands used to query event data

Answer : C

This is the correct answer for the same reason as above. The Events Data Dictionary provides a reference of information about the events found in the Investigate > Event Search page of the Falcon Console, which is useful for writing hunting queries. It does not provide pre-defined queries, detect names and descriptions, or compatible splunk commands.

Question 6

Which of the following would be the correct field name to find the name of an event?

AEvent_SimpleName

BEvent_Simple_Name

CEVENT_SIMPLE_NAME

Devent_simpleName

Answer : A

Event_SimpleName is the correct field name to find the name of an event in Falcon Event Search. It is a field that shows the simplified name of each event type, such as ProcessRollup2, DnsRequest, or FileDelete. Event_Simple_Name, EVENT_SIMPLE_NAME, and event_simpleName are not valid field names for finding the name of an event.

Question 7

Which SPL (Splunk) field name can be used to automatically convert Unix times (Epoch) to UTC readable time within the Flacon Event Search?

Autc_time

Bconv_time

C_time

Dtime

Answer : C

_time is the SPL (Splunk) field name that can be used to automatically convert Unix times (Epoch) to UTC readable time within the Falcon Event Search. It is a default field that shows the timestamp of each event in a human-readable format. utc_time, conv_time, and time are not valid SPL field names for converting Unix times to UTC readable time.

CrowdStrike CCFH-202 CrowdStrike Certified Falcon Hunter Exam Practice Test