Falcon Hunter CCFH-202 Practice Questions & Answers • ExamPrepare

64 questions in this view

Page 1 of 11

Question 1

How much experience do you have as a Falcon Hunter?

< 6 months
7–11 months
1–2 years
> 2 years

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 2

How closely did the questions on the exam align to your experience as a Falcon Hunter?

Very aligned
Somewhat aligned
Not at all aligned

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 3

Your intel team has come to you asking if you can search for a particular IP address that has been associated with a supply chain attack. Your company stopped using the software almost six months ago.

Where can you review the data retention setting of the hunting data?

Investigate > Data settings
Next-Gen SIEM > Data management
Dashboards and reports > Billing > Usage
Support and resources > General settings

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 4

You are investigating suspicious usage of the process powershell.exe within Advanced event search and want to ensure the parent processes CSFalconService.exe and w3wp.exe are not included in the results.

Which option should you add to your query to exclude both CSFalconService.exe and w3wp.exe from the results?

| ParentBaseFileName != "CSFalconService.exe" OR ParentBaseFileName != "explorer.exe"
| !in(field="ImageFileName", values=["CSFalconService.exe","w3wp.exe"])
| !in(field="ParentBaseFileName", values=["CSFalconService.exe","w3wp.exe"])
| ParentBaseFileName != "CSFalconService.exe","w3wp.exe"

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 5

You are investigating a potential data exfiltration event on a finance department workstation. During your investigation, you gather the following information:

• A large volume of files were compressed into a .zip archive in the user's Documents folder two hours ago

• The compression was performed by 7zip.exe, which is an approved and commonly used tool in the finance department

• Immediately following the compression, a NetworkConnectIP4 event shows an outbound connection to an external IP address with no prior connection history in the environment

• The external IP resolves to a legitimate cloud storage provider used by the organization

• No Falcon detection was generated for any of these events

Which conclusion is best supported by the available evidence?

The activity is inconclusive and no further action is needed until a Falcon detection is generated for one of these events
The activity is confirmed non-malicious
The activity is confirmed malicious
The activity warrants further investigation

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 6

Which action helps identify an enterprise-wide file infection?

Review the Search by process context dashboard for FileWritten events
Utilize CrowdStrike Query Language (CQL) to search for files with the same hashes that have been renamed
Utilize the IP addresses Investigate dashboard to find the host processes that are connecting to an unusual IP
Analyze the Hosts dashboard to identify endpoints with high-risk file activity

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.