62 Q&As in UPDATED CCFH-202 Exam Questions Certification Test Engine to PDF
Get The Important Preparation Guide With CCFH-202 Dumps
CrowdStrike CCFH-202 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
| Topic 6 |
|
| Topic 7 |
|
| Topic 8 |
|
NEW QUESTION # 25
Which Falcon documentation guide should you reference to hunt for anomalies related to scheduled tasks and other Windows related artifacts?
- A. MITRE-Based Falcon Detections Framework
- B. Hunting and Investigation
- C. Events Data Dictionary
- D. Customizable Dashboards
Answer: B
Explanation:
The Hunting and Investigation guide is the Falcon documentation guide that you should reference to hunt for anomalies related to scheduled tasks and other Windows related artifacts. The Hunting and Investigation guide provides sample hunting queries, select walkthroughs, and best practices for hunting with Falcon. It covers various topics such as process execution, network connections, registry activity, scheduled tasks, and more.
NEW QUESTION # 26
Which of the following is the proper method to quantify search results, enabling a hunter to quickly sort and identify outliers?
- A. Exporting Event Search results to a spreadsheet and aggregating the results
- B. Using the "|stats count" command at the end of a search string in Event Search
- C. Using the "| stats count by" command at the end of a search string in Event Search
- D. Using the "|eval" command at the end of a search string in Event Search
Answer: C
Explanation:
This is the proper method to quantify search results, enabling a hunter to quickly sort and identify outliers. The stats command is used to calculate summary statistics on the results of a search or subsearch, such as count, sum, average, etc. The count by option is used to count the number of events for each distinct value of a field or fields and display them in a table. This can help find rare or common values that could indicate anomalies or deviations from normal behavior.
NEW QUESTION # 27
Which Falcon documentation guide should you reference to hunt for anomalies related to scheduled tasks and other Windows related artifacts?
- A. MITRE-Based Falcon Detections Framework
- B. Hunting and Investigation
- C. Events Data Dictionary
- D. Customizable Dashboards
Answer: B
Explanation:
The Hunting and Investigation guide is the Falcon documentation guide that you should reference to hunt for anomalies related to scheduled tasks and other Windows related artifacts. The Hunting and Investigation guide provides sample hunting queries, select walkthroughs, and best practices for hunting with Falcon. It covers various topics such as process execution, network connections, registry activity, scheduled tasks, and more.
NEW QUESTION # 28
What is the main purpose of the Mac Sensor report?
- A. To provide a dashboard for Mac related detections
- B. To identify endpoints that are in Reduced Functionality Mode
- C. To provide vulnerability assessment for Mac Operating Systems
- D. To provide a summary view of selected activities on Mac hosts
Answer: D
Explanation:
The Mac Sensor report is a pre-defined report that provides a summary view of selected activities on Mac hosts. It shows information such as process execution events, network connection events, file write events, etc. that occurred on Mac hosts within a specified time range. The Mac Sensor report does not identify endpoints that are in Reduced Functionality Mode, provide vulnerability assessment for Mac Operating Systems, or provide a dashboard for Mac related detections.
NEW QUESTION # 29
Where would an analyst find information about shells spawned by root, Kernel Module loads, and wget/curl usage?
- A. Sensor Health report
- B. Mac Sensor report
- C. Sensor Policy Daily report
- D. Linux Sensor report
Answer: D
Explanation:
The Linux Sensor report is where an analyst would find information about shells spawned by root, Kernel Module loads, and wget/curl usage. The Linux Sensor report is a pre-defined report that provides a summary view of selected activities on Linux hosts. It shows information such as process execution events, network connection events, file write events, etc. that occurred on Linux hosts within a specified time range. The Sensor Health report, the Sensor Policy Daily report, and the Mac Sensor report do not provide the same information.
NEW QUESTION # 30
What information is provided when using IP Search to look up an IP address?
- A. Both internal and external IPs
- B. Internal IPs only
- C. Suspicious IP addresses
- D. External IPs only
Answer: D
Explanation:
IP Search is an Investigate tool that allows you to look up information about external IPs only. It shows information such as geolocation, network connection events, detection history, etc. for each external IP address that has communicated with your hosts. It does not show information about internal IPs, suspicious IPs, or both internal and external IPs.
NEW QUESTION # 31
What elements are required to properly execute a Process Timeline?
- A. Agent ID (AID) and Target Process ID
- B. Hostname and Local Process ID
- C. Target Process ID only
- D. Agent ID (AID) only
Answer: A
Explanation:
The Agent ID (AID) and the Target Process ID are the elements that are required to properly execute a Process Timeline. The Agent ID (AID) is a unique identifier for each host that has a Falcon sensor installed. The Target Process ID is the decimal representation of the process identifier for the process that you want to investigate. These two elements are used to query the cloud for the events related to the process on the host. The Agent ID (AID) only, the Hostname and Local Process ID, and the Target Process ID only are not sufficient to execute a Process Timeline.
NEW QUESTION # 32
You need details about key data fields and sensor events which you may expect to find from Hosts running the Falcon sensor. Which documentation should you access?
- A. Events Data Dictionary
- B. Streaming API Event Dictionary
- C. Event stream APIs
- D. Hunting and Investigation
Answer: A
Explanation:
The Events Data Dictionary found in the Falcon documentation is useful for writing hunting queries because it provides a reference of information about the events found in the Investigate > Event Search page of the Falcon Console. The Events Data Dictionary describes each event type, field name, data type, description, and example value that can be used to query and analyze event data. The Streaming API Event Dictionary, Hunting and Investigation, and Event stream APIs are not documentation that provide details about key data fields and sensor events.
NEW QUESTION # 33
Which of the following is an example of actor actions during the RECONNAISSANCE phase of the Cyber Kill Chain?
- A. Loading a malicious payload into a common DLL
- B. Installing a backdoor on the victim endpoint
- C. Emailing the intended victim with a malware attachment
- D. Discovering internet-facing servers
Answer: D
Explanation:
Discovering internet-facing servers is an example of actor actions during the RECONNAISSANCE phase of the Cyber Kill Chain. The RECONNAISSANCE phase is where the adversary researches and identifies targets, vulnerabilities, and attack vectors. Discovering internet-facing servers is a way for the adversary to find potential entry points or weaknesses in the target network.
NEW QUESTION # 34
The Falcon Detections page will attempt to decode Encoded PowerShell Command line parameters when which PowerShell Command line parameter is present?
- A. -nop
- B. -e
- C. -Hidden
- D. -Command
Answer: D
Explanation:
The Falcon Detections page will attempt to decode Encoded PowerShell Command line parameters when the -Command parameter is present. The -Command parameter allows PowerShell to execute a specified script block or string. If the script block or string is encoded using Base64 or other methods, the Falcon Detections page will try to decode it and show the original command. The -Hidden, -e, and -nop parameters are not related to encoding or decoding PowerShell commands.
NEW QUESTION # 35
Which of the following is an example of a Falcon threat hunting lead?
- A. An external report describing a unique 5 character file extension for ransomware encrypted files
- B. A routine threat hunt query showing process executions of single letter filename (e.g., a.exe) from temporary directories
- C. A help desk ticket for a user clicking on a link in an email causing their machine to become unresponsive and have high CPU usage
- D. Security appliance logs showing potentially bad traffic to an unknown external IP address
Answer: B
Explanation:
A Falcon threat hunting lead is a piece of information that can be used to initiate or guide a threat hunting activity within the Falcon platform. A routine threat hunt query showing process executions of single letter filename (e.g., a.exe) from temporary directories is an example of a Falcon threat hunting lead, as it can indicate potential malicious activity that can be further investigated using Falcon data and features. Security appliance logs, help desk tickets, and external reports are not examples of Falcon threat hunting leads, as they are not directly related to the Falcon platform or data.
NEW QUESTION # 36
SPL (Splunk) eval statements can be used to convert Unix times (Epoch) into UTC readable time Which eval function is correct^
- A. strftime
- B. relative time
- C. now
- D. typeof
Answer: A
Explanation:
The strftime eval function is used to convert Unix times (Epoch) into UTC readable time. It takes two arguments: a Unix time field and a format string that specifies how to display the time. The now, typeof, and relative_time eval functions are not used to convert Unix times into UTC readable time.
NEW QUESTION # 37
Which of the following Event Search queries would only find the DNS lookups to the domain: www randomdomain com?
- A. event_simpleName=DnsRequest DomainName=randomdomain com ComputerName=localhost
- B. ComputerName=localhost DnsRequest "randomdomain com"
- C. Dns=randomdomain com
- D. event_simpleName=DnsRequest DomainName=www randomdomain com
Answer: D
Explanation:
This Event Search query would only find the DNS lookups to the domain www randomdomain com, as it specifies the exact event type and domain name to match. The other queries would either find other events or domains that are not relevant to the question.
NEW QUESTION # 38
SPL (Splunk) eval statements can be used to convert Unix times (Epoch) into UTC readable time Which eval function is correct^
- A. strftime
- B. relative time
- C. now
- D. typeof
Answer: A
Explanation:
The strftime eval function is used to convert Unix times (Epoch) into UTC readable time. It takes two arguments: a Unix time field and a format string that specifies how to display the time. The now, typeof, and relative_time eval functions are not used to convert Unix times into UTC readable time.
NEW QUESTION # 39
Which of the following is a recommended technique to find unique outliers among a set of data in the Falcon Event Search?
- A. Time-based Searching
- B. Stacking (Frequency Analysis)
- C. Machine Learning
- D. Hunt-and-Peck Search Methodology
Answer: B
Explanation:
Stacking (Frequency Analysis) is a recommended technique to find unique outliers among a set of data in the Falcon Event Search. As explained above, stacking involves grouping events by a common attribute and counting their frequency, then sorting them by ascending or descending order to identify rare or common events. This can help find anomalies or deviations from normal behavior that could indicate malicious activity. Hunt-and-Peck Search Methodology, Time-based Searching, and Machine Learning are not specific techniques to find unique outliers among a set of data.
NEW QUESTION # 40
Which of the following is TRUE about a Hash Search?
- A. Module Load History is not presented in a Hash Search
- B. The Hash Search provides Process Execution History
- C. Wildcard searches are not permitted with the Hash Search
- D. The Hash Search is available on Linux
Answer: B
Explanation:
The Hash Search is an Investigate tool that allows you to search for a file hash and view its process execution history across all hosts in your environment. It shows information such as process name, command line, parent process name, parent command line, etc. for each execution of the file hash. Wildcard searches are permitted with the Hash Search, as long as they are at least four characters long. The Hash Search is available on Linux, as well as Windows and Mac OS X. Module Load History is presented in a Hash Search, along with other information such as File Write History and Detection History.
NEW QUESTION # 41
In the Powershell Hunt report, what does the filtering condition of commandLine! ="*badstring* " do?
- A. Highlights only the command lines containing "badstring"
- B. Highlights "badstring" in all command lines in the output
- C. Displays only the command lines containing "badstring"
- D. Prevents command lines containing "badstring" from being displayed
Answer: D
Explanation:
In the Powershell Hunt report, the filtering condition of commandLine! ="badstring " prevents command lines containing "badstring" from being displayed. The ! operator is used to negate or exclude a condition from the search results. The * operator is used as a wildcard to match any number of characters before or after the specified string. Therefore, commandLine! ="badstring " means to filter out any command line that has "badstring" anywhere in it. The other options are not correct, as they do not describe what the filtering condition does.
NEW QUESTION # 42
You want to produce a list of all event occurrences along with selected fields such as the full path, time, username etc. Which command would be the appropriate choice?
- A. table
- B. fields
- C. distinct count
- D. values
Answer: A
Explanation:
The table command is used to produce a list of all event occurrences along with selected fields such as the full path, time, username etc. It takes one or more field names as arguments and displays them in a tabular format. The fields command is used to keep or remove fields from search results, not to display them in a list. The distinct_count command is used to count the number of distinct values of a field, not to display them in a list. The values command is used to display a list of unique values of a field within each group, not to display all event occurrences.
NEW QUESTION # 43
While you're reviewing Unresolved Detections in the Host Search page, you notice the User Name column contains "hostnameS " What does this User Name indicate?
- A. The User Name is not relevant for the dashboard
- B. There is no User Name associated with the event
- C. The Falcon sensor could not determine the User Name
- D. The User Name is a System User
Answer: B
Explanation:
When you see "hostnameS" in the User Name column in the Host Search page, it means that there is no User Name associated with the event. This can happen when the event is related to a system process or service that does not have a user context. It does not mean that the User Name is a System User, that the User Name is not relevant for the dashboard, or that the Falcon sensor could not determine the User Name.
NEW QUESTION # 44
Which of the following best describes the purpose of the Mac Sensor report?
- A. The Mac Sensor report displays a listing of all Mac hosts with a Falcon sensor installed
- B. The Mac Sensor report displays a listing of all Mac hosts without a Falcon sensor installed
- C. The Mac Sensor report provides a detection focused view of known malicious activities occurring on Mac hosts, including machine-learning and indicator-based detections
- D. The Mac Sensor report provides a comprehensive view of activities occurring on Mac hosts, including items of interest that may be hunting or investigation leads
Answer: D
Explanation:
This is the correct answer for the same reason as above. The Mac Sensor report provides a comprehensive view of activities occurring on Mac hosts, including items of interest that may be hunting or investigation leads. It does not display a listing of all Mac hosts with or without a Falcon sensor installed, nor does it provide a detection focused view of known malicious activities occurring on Mac hosts.
NEW QUESTION # 45
When performing a raw event search via the Events search page, what are Event Actions?
- A. Event Actions contains the summary of actions taken by the Falcon sensor such as quarantining a file, prevent a process from executing or taking no actions and creating a detection only
- B. Event Actions contains an audit information log of actions an analyst took in regards to a specific detection
- C. Event Actions is the field name that contains the event name defined in the Events Data Dictionary such as ProcessRollup, SyntheticProcessRollup, DNS request, etc
- D. Event Actions are pivotable workflows including connecting to a host, pre-made event searches and pivots to other investigatory pages such as host search
Answer: D
Explanation:
When performing a raw event search via the Events search page, Event Actions are pivotable workflows that allow you to perform various tasks related to the event or the host. For example, you can connect to a host using Real Time Response, run pre-made event searches based on the event type or name, or pivot to other investigatory pages such as host search, hash search, etc. Event Actions do not contain audit information log, summary of actions taken by the Falcon sensor, or the event name defined in the Events Data Dictionary.
NEW QUESTION # 46
Which field in a DNS Request event points to the responsible process?
- A. TargetProcessld_decimal
- B. ParentProcessId_decimal
- C. ContextProcessld_decimal
- D. ContextProcessld_readable
Answer: D
Explanation:
The ContextProcessld_readable field in a DNS Request event points to the responsible process. The ContextProcessld_readable field is the readable representation of the process identifier for the process that initiated the DNS request. It can be used to identify which process was communicating with a specific domain or IP address. The TargetProcessld_decimal, ContextProcessld_decimal, and ParentProcessId_decimal fields do not point to the responsible process.
NEW QUESTION # 47
What information is shown in Host Search?
- A. Quarantined Files
- B. Intel Reports
- C. Prevention Policies
- D. Processes and Services
Answer: D
Explanation:
Processes and Services is one of the information that is shown in Host Search. Host Search is an Investigate tool that allows you to view events by category, such as process executions, network connections, file writes, etc. Processes and Services is one of the categories that shows information such as process name, command line, parent process name, parent command line, etc. for each process execution event on a host. Quarantined Files, Prevention Policies, and Intel Reports are not shown in Host Search.
NEW QUESTION # 48
......
Prepare With Top Rated High-quality CCFH-202 Dumps For Success in Exam: https://www.prepawayete.com/CrowdStrike/CCFH-202-practice-exam-dumps.html
Get Totally Free Updates on CCFH-202 Dumps PDF Questions: https://drive.google.com/open?id=1xb1TRjaKkLmCwKLNXSA-E89blC8rumqy