[Jul 11, 2023] Download Free CrowdStrike CCFH-202 Real Exam Questions
Pass Your Exam With 100% Verified CCFH-202 Exam Questions
NEW QUESTION # 24
Event Search data is recorded with which time zone?
- A. GMT
- B. EST
- C. PST
- D. UTC
Answer: D
Explanation:
Event Search data is recorded with UTC (Coordinated Universal Time) time zone. UTC is a standard time zone that is used as a reference point for other time zones. PST (Pacific Standard Time), GMT (Greenwich Mean Time), and EST (Eastern Standard Time) are not the time zones that Event Search data is recorded with.
NEW QUESTION # 25
What is the main purpose of the Mac Sensor report?
- A. To provide a dashboard for Mac related detections
- B. To identify endpoints that are in Reduced Functionality Mode
- C. To provide vulnerability assessment for Mac Operating Systems
- D. To provide a summary view of selected activities on Mac hosts
Answer: D
Explanation:
The Mac Sensor report is a pre-defined report that provides a summary view of selected activities on Mac hosts. It shows information such as process execution events, network connection events, file write events, etc. that occurred on Mac hosts within a specified time range. The Mac Sensor report does not identify endpoints that are in Reduced Functionality Mode, provide vulnerability assessment for Mac Operating Systems, or provide a dashboard for Mac related detections.
NEW QUESTION # 26
An analyst has sorted all recent detections in the Falcon platform to identify the oldest in an effort to determine the possible first victim host What is this type of analysis called?
- A. Temporal analysis
- B. Visualization of hosts
- C. Statistical analysis
- D. Machine Learning
Answer: A
Explanation:
Temporal analysis is a type of analysis that focuses on the timing and sequence of events in order to identify patterns, trends, or anomalies. By sorting all recent detections in the Falcon platform to identify the oldest, an analyst can perform temporal analysis to determine the possible first victim host and trace back the origin of an attack.
NEW QUESTION # 27
Which field should you reference in order to find the system time of a *FileWritten event?
- A. timestamp
- B. ProcessStartTime_decimal
- C. FileTimeStamp_decimal
- D. ContextTimeStamp_decimal
Answer: D
Explanation:
ContextTimeStamp_decimal is the field that shows the system time of the event that triggered the sensor to send data to the cloud. In this case, it would be the time when the file was written. FileTimeStamp_decimal is the field that shows the last modified time of the file, which may not be the same as the time when the file was written. ProcessStartTime_decimal is the field that shows the start time of the process that performed the file write operation, which may not be the same as the time when the file was written. Timestamp is the field that shows the time when the sensor data was received by the cloud, which may not be the same as the time when the file was written.
NEW QUESTION # 28
SPL (Splunk) eval statements can be used to convert Unix times (Epoch) into UTC readable time Which eval function is correct^
- A. relative time
- B. strftime
- C. typeof
- D. now
Answer: B
Explanation:
The strftime eval function is used to convert Unix times (Epoch) into UTC readable time. It takes two arguments: a Unix time field and a format string that specifies how to display the time. The now, typeof, and relative_time eval functions are not used to convert Unix times into UTC readable time.
NEW QUESTION # 29
Which of the following is a way to create event searches that run automatically and recur on a schedule that you set?
- A. Event Search
- B. Workflows
- C. Scheduled Searches
- D. Scheduled Reports
Answer: C
Explanation:
Scheduled Searches are a way to create event searches that run automatically and recur on a schedule that you set. You can use Scheduled Searches to monitor your environment for specific conditions or patterns, generate reports or alerts, or enrich your data with additional fields or tags. Workflows, Event Search, and Scheduled Reports are not ways to create event searches that run automatically and recur on a schedule.
NEW QUESTION # 30
What Search page would help a threat hunter differentiate testing, DevOPs, or general user activity from adversary behavior?
- A. User Search
- B. Domain Search
- C. IP Search
- D. Hash Search
Answer: A
Explanation:
User Search is a search page that allows a threat hunter to search for user activity across endpoints and correlate it with other events. This can help differentiate testing, DevOPs, or general user activity from adversary behavior by identifying anomalous or suspicious user actions, such as logging into multiple systems, running unusual commands, or accessing sensitive files.
NEW QUESTION # 31
Lateral movement through a victim environment is an example of which stage of the Cyber Kill Chain?
- A. Actions on Objectives
- B. Exploitation
- C. Command & Control
- D. Delivery
Answer: C
Explanation:
Lateral movement through a victim environment is an example of the Command & Control stage of the Cyber Kill Chain. The Cyber Kill Chain is a model that describes the phases of a cyber attack, from reconnaissance to actions on objectives. The Command & Control stage is where the adversary establishes and maintains communication with the compromised systems and moves laterally to expand their access and control.
NEW QUESTION # 32
What topics are presented in the Hunting and Investigation Guide?
- A. Recommended platform configurations and prevention settings to ensure detections are generated for hunting leads
- B. Detailed tutorial on writing advanced queries such as sub-searches and joins
- C. Sample hunting queries, select walkthroughs and best practices for hunting with Falcon
- D. Detailed summary of event names, descriptions, and some key data fields for hunting and investigation
Answer: C
Explanation:
This is the correct answer for the same reason as above. The Hunting and Investigation guide provides sample hunting queries, select walkthroughs, and best practices for hunting with Falcon. It does not provide a detailed tutorial on writing advanced queries, a detailed summary of event names and descriptions, or recommended platform configurations and prevention settings.
NEW QUESTION # 33
In the MITRE ATT&CK Framework (version 11 - the newest version released in April 2022), which of the following pair of tactics is not in the Enterprise: Windows matrix?
- A. Privilege Escalation and Initial Access
- B. Persistence and Execution
- C. Impact and Collection
- D. Reconnaissance and Resource Development
Answer: D
Explanation:
Reconnaissance and Resource Development are two tactics that are not in the Enterprise: Windows matrix of the MITRE ATT&CK Framework (version 11). These two tactics are part of the PRE-ATT&CK matrix, which covers the actions that adversaries take before compromising a target. The Enterprise: Windows matrix covers the actions that adversaries take after gaining initial access to a Windows system. Persistence, Execution, Impact, Collection, Privilege Escalation, and Initial Access are all tactics that are in the Enterprise: Windows matrix.
NEW QUESTION # 34
The Process Timeline Events Details table will populate the Parent Process ID and the Parent File columns when the cloudable Event data contains which event field?
- A. RawProcessld_decimal
- B. RpcProcessld_decimal
- C. ParentProcessld_decimal
- D. ContextProcessld_decimal
Answer: C
Explanation:
The ParentProcessld_decimal event field is what the Process Timeline Events Details table will populate the Parent Process ID and the Parent File columns with when the cloudable Event data contains it. The ParentProcessld_decimal event field is the decimal representation of the process identifier for the parent process of the target process. It can be used to trace the process ancestry and identify potential malicious activity. The ContextProcessld_decimal, RawProcessld_decimal, and RpcProcessld_decimal event fields are not used to populate the Parent Process ID and the Parent File columns.
NEW QUESTION # 35
The Falcon Detections page will attempt to decode Encoded PowerShell Command line parameters when which PowerShell Command line parameter is present?
- A. -nop
- B. -Hidden
- C. -Command
- D. -e
Answer: C
Explanation:
The Falcon Detections page will attempt to decode Encoded PowerShell Command line parameters when the -Command parameter is present. The -Command parameter allows PowerShell to execute a specified script block or string. If the script block or string is encoded using Base64 or other methods, the Falcon Detections page will try to decode it and show the original command. The -Hidden, -e, and -nop parameters are not related to encoding or decoding PowerShell commands.
NEW QUESTION # 36
What information is provided when using IP Search to look up an IP address?
- A. External IPs only
- B. Both internal and external IPs
- C. Suspicious IP addresses
- D. Internal IPs only
Answer: A
Explanation:
IP Search is an Investigate tool that allows you to look up information about external IPs only. It shows information such as geolocation, network connection events, detection history, etc. for each external IP address that has communicated with your hosts. It does not show information about internal IPs, suspicious IPs, or both internal and external IPs.
NEW QUESTION # 37
Which of the following is the proper method to quantify search results, enabling a hunter to quickly sort and identify outliers?
- A. Exporting Event Search results to a spreadsheet and aggregating the results
- B. Using the "|stats count" command at the end of a search string in Event Search
- C. Using the "| stats count by" command at the end of a search string in Event Search
- D. Using the "|eval" command at the end of a search string in Event Search
Answer: C
Explanation:
This is the proper method to quantify search results, enabling a hunter to quickly sort and identify outliers. The stats command is used to calculate summary statistics on the results of a search or subsearch, such as count, sum, average, etc. The count by option is used to count the number of events for each distinct value of a field or fields and display them in a table. This can help find rare or common values that could indicate anomalies or deviations from normal behavior.
NEW QUESTION # 38
In the Powershell Hunt report, what does the "score" signify?
- A. Number of hosts that ran the PowerShell script
- B. How recently the PowerShell script executed
- C. A cumulative score of the various potential command line switches
- D. Maliciousness score determined by NGAV
Answer: C
Explanation:
In the Powershell Hunt report, the score signifies a cumulative score of the various potential command line switches that were used in the PowerShell script execution. The score is based on a weighted system that assigns different values to different switches based on their potential maliciousness or usefulness for threat hunting. For example, -EncodedCommand has a higher value than -NoProfile. The score does not signify the number of hosts that ran the PowerShell script, how recently the PowerShell script executed, or the maliciousness score determined by NGAV.
NEW QUESTION # 39
What information is shown in Host Search?
- A. Prevention Policies
- B. Processes and Services
- C. Quarantined Files
- D. Intel Reports
Answer: B
Explanation:
Processes and Services is one of the information that is shown in Host Search. Host Search is an Investigate tool that allows you to view events by category, such as process executions, network connections, file writes, etc. Processes and Services is one of the categories that shows information such as process name, command line, parent process name, parent command line, etc. for each process execution event on a host. Quarantined Files, Prevention Policies, and Intel Reports are not shown in Host Search.
NEW QUESTION # 40
Which of the following is TRUE about a Hash Search?
- A. The Hash Search provides Process Execution History
- B. The Hash Search is available on Linux
- C. Wildcard searches are not permitted with the Hash Search
- D. Module Load History is not presented in a Hash Search
Answer: A
Explanation:
The Hash Search is an Investigate tool that allows you to search for a file hash and view its process execution history across all hosts in your environment. It shows information such as process name, command line, parent process name, parent command line, etc. for each execution of the file hash. Wildcard searches are permitted with the Hash Search, as long as they are at least four characters long. The Hash Search is available on Linux, as well as Windows and Mac OS X. Module Load History is presented in a Hash Search, along with other information such as File Write History and Detection History.
NEW QUESTION # 41
Which of the following is an example of a Falcon threat hunting lead?
- A. A routine threat hunt query showing process executions of single letter filename (e.g., a.exe) from temporary directories
- B. A help desk ticket for a user clicking on a link in an email causing their machine to become unresponsive and have high CPU usage
- C. Security appliance logs showing potentially bad traffic to an unknown external IP address
- D. An external report describing a unique 5 character file extension for ransomware encrypted files
Answer: A
Explanation:
A Falcon threat hunting lead is a piece of information that can be used to initiate or guide a threat hunting activity within the Falcon platform. A routine threat hunt query showing process executions of single letter filename (e.g., a.exe) from temporary directories is an example of a Falcon threat hunting lead, as it can indicate potential malicious activity that can be further investigated using Falcon data and features. Security appliance logs, help desk tickets, and external reports are not examples of Falcon threat hunting leads, as they are not directly related to the Falcon platform or data.
NEW QUESTION # 42
......
CrowdStrike CCFH-202 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
| Topic 6 |
|
| Topic 7 |
|
CCFH-202 Dumps 100 Pass Guarantee With Latest Demo: https://www.actual4cert.com/CCFH-202-real-questions.html
CCFH-202 Dumps PDF - CCFH-202 Real Exam Questions Answers: https://drive.google.com/open?id=1KamjSVhAg51SalgK8Pa_GVyQFWar_iBN