Updated CCFH-202 Dumps (V10.03) – The Latest Questions for Better CrowdStrike Certified Falcon Hunter (CCFH) Exam Preparation

1. Which of the following is a suspicious process behavior?

2. Which field should you reference in order to find the system time of a *FileWritten event?

3. What Search page would help a threat hunter differentiate testing, DevOPs, or general user activity from adversary behavior?

4. An analyst has sorted all recent detections in the Falcon platform to identify the oldest in an effort to determine the possible first victim host What is this type of analysis called?

5. Refer to Exhibit.

Falcon detected the above file attempting to execute.

At initial glance; what indicators can we use to provide an initial analysis of the file?

6. A benefit of using a threat hunting framework is that it:

7. Which of the following is an example of a Falcon threat hunting lead?

8. The Falcon Detections page will attempt to decode Encoded PowerShell Command line parameters when which PowerShell Command line parameter is present?

9. Which structured analytic technique contrasts different hypotheses to determine which is the best leading (prioritized) hypothesis?

10. Which SPL (Splunk) field name can be used to automatically convert Unix times (Epoch) to UTC readable time within the Flacon Event Search?

11. Which of the following would be the correct field name to find the name of an event?

12. Event Search data is recorded with which time zone?

13. Which of the following Event Search queries would only find the DNS lookups to the domain: www randomdomain com?

14. How do you rename fields while using transforming commands such as table, chart, and stats?

15. SPL (Splunk) eval statements can be used to convert Unix times (Epoch) into UTC readable time Which eval function is correct^

16. Which of the following queries will return the parent processes responsible for launching badprogram exe?

17. You want to produce a list of all event occurrences along with selected fields such as the full path, time, username etc.

Which command would be the appropriate choice?

18. When exporting the results of the following event search, what data is saved in the exported file (assuming Verbose Mode)? event_simpleName=*Written | stats count by ComputerName

19. The help desk is reporting an increase in calls related to user accounts being locked out over the last few days. You suspect that this could be an attack by an adversary against your organization. Select the best hunting hypothesis from the following:

20. To find events that are outliers inside a network,___________is the best hunting method to use.