2024 Latest CCFH-202 DUMPS Q&As with Explanations Verified & Correct Answers
CCFH-202 dumps Exam Material with 62 Questions
NEW QUESTION # 16
Which of the following is the proper method to quantify search results, enabling a hunter to quickly sort and identify outliers?
- A. Exporting Event Search results to a spreadsheet and aggregating the results
- B. Using the "| stats count by" command at the end of a search string in Event Search
- C. Using the "|eval" command at the end of a search string in Event Search
- D. Using the "|stats count" command at the end of a search string in Event Search
Answer: B
Explanation:
This is the proper method to quantify search results, enabling a hunter to quickly sort and identify outliers. The stats command is used to calculate summary statistics on the results of a search or subsearch, such as count, sum, average, etc. The count by option is used to count the number of events for each distinct value of a field or fields and display them in a table. This can help find rare or common values that could indicate anomalies or deviations from normal behavior.
NEW QUESTION # 17
What do you click to jump to a Process Timeline from many pages in Falcon, such as a Hash Search?
- A. PID
- B. CID
- C. Process Timeline Link
- D. Process ID or Parent Process ID
Answer: C
Explanation:
The Process Timeline Link is what you click to jump to a Process Timeline from many pages in Falcon, such as a Hash Search. The Process Timeline Link is an icon that looks like three horizontal bars with dots on them. It appears next to each process name or ID on various pages in Falcon, such as Hash Search results, Detection details, Event Search results, etc. Clicking on it will open a new tab with the Process Timeline for that process. The PID, the Process ID or Parent Process ID, and the CID are not what you click to jump to a Process Timeline.
NEW QUESTION # 18
In the Powershell Hunt report, what does the "score" signify?
- A. A cumulative score of the various potential command line switches
- B. Number of hosts that ran the PowerShell script
- C. Maliciousness score determined by NGAV
- D. How recently the PowerShell script executed
Answer: A
Explanation:
In the Powershell Hunt report, the score signifies a cumulative score of the various potential command line switches that were used in the PowerShell script execution. The score is based on a weighted system that assigns different values to different switches based on their potential maliciousness or usefulness for threat hunting. For example, -EncodedCommand has a higher value than -NoProfile. The score does not signify the number of hosts that ran the PowerShell script, how recently the PowerShell script executed, or the maliciousness score determined by NGAV.
NEW QUESTION # 19
What topics are presented in the Hunting and Investigation Guide?
- A. Sample hunting queries, select walkthroughs and best practices for hunting with Falcon
- B. Recommended platform configurations and prevention settings to ensure detections are generated for hunting leads
- C. Detailed summary of event names, descriptions, and some key data fields for hunting and investigation
- D. Detailed tutorial on writing advanced queries such as sub-searches and joins
Answer: A
Explanation:
This is the correct answer for the same reason as above. The Hunting and Investigation guide provides sample hunting queries, select walkthroughs, and best practices for hunting with Falcon. It does not provide a detailed tutorial on writing advanced queries, a detailed summary of event names and descriptions, or recommended platform configurations and prevention settings.
NEW QUESTION # 20
Which tool allows a threat hunter to populate and colorize all known adversary techniques in a single view?
- A. MISP
- B. OWASP Threat Dragon
- C. OpenXDR
- D. MITRE ATT&CK Navigator
Answer: D
Explanation:
MITRE ATT&CK Navigator is a tool that allows a threat hunter to populate and colorize all known adversary techniques in a single view. It is based on the MITRE ATT&CK framework, which is a knowledge base of adversary behaviors and tactics. The tool enables threat hunters to create custom matrices, layers, annotations, and filters to explore and model specific adversary techniques, with links to intelligence and case studies.
NEW QUESTION # 21
SPL (Splunk) eval statements can be used to convert Unix times (Epoch) into UTC readable time Which eval function is correct^
- A. strftime
- B. relative time
- C. now
- D. typeof
Answer: A
Explanation:
The strftime eval function is used to convert Unix times (Epoch) into UTC readable time. It takes two arguments: a Unix time field and a format string that specifies how to display the time. The now, typeof, and relative_time eval functions are not used to convert Unix times into UTC readable time.
NEW QUESTION # 22
Where would an analyst find information about shells spawned by root, Kernel Module loads, and wget/curl usage?
- A. Sensor Policy Daily report
- B. Mac Sensor report
- C. Sensor Health report
- D. Linux Sensor report
Answer: D
Explanation:
The Linux Sensor report is where an analyst would find information about shells spawned by root, Kernel Module loads, and wget/curl usage. The Linux Sensor report is a pre-defined report that provides a summary view of selected activities on Linux hosts. It shows information such as process execution events, network connection events, file write events, etc. that occurred on Linux hosts within a specified time range. The Sensor Health report, the Sensor Policy Daily report, and the Mac Sensor report do not provide the same information.
NEW QUESTION # 23
While you're reviewing Unresolved Detections in the Host Search page, you notice the User Name column contains "hostnameS " What does this User Name indicate?
- A. The Falcon sensor could not determine the User Name
- B. There is no User Name associated with the event
- C. The User Name is not relevant for the dashboard
- D. The User Name is a System User
Answer: B
Explanation:
When you see "hostnameS" in the User Name column in the Host Search page, it means that there is no User Name associated with the event. This can happen when the event is related to a system process or service that does not have a user context. It does not mean that the User Name is a System User, that the User Name is not relevant for the dashboard, or that the Falcon sensor could not determine the User Name.
NEW QUESTION # 24
Which of the following is a suspicious process behavior?
- A. PowerShell launching a PowerShell script
- B. An Internet browser (eg, Internet Explorer) performing multiple DNS requests
- C. Non-network processes (eg, notepad exe) making an outbound network connection
- D. PowerShell running an execution policy of RemoteSigned
Answer: C
Explanation:
Non-network processes are processes that are not expected to communicate over the network, such as notepad.exe. If they make an outbound network connection, it could indicate that they are compromised or maliciously used by an adversary. PowerShell running an execution policy of RemoteSigned is a default setting that allows local scripts to run without digital signatures. An Internet browser performing multiple DNS requests is a normal behavior for web browsing. PowerShell launching a PowerShell script is also a common behavior for legitimate tasks.
NEW QUESTION # 25
What is the main purpose of the Mac Sensor report?
- A. To provide a summary view of selected activities on Mac hosts
- B. To provide vulnerability assessment for Mac Operating Systems
- C. To provide a dashboard for Mac related detections
- D. To identify endpoints that are in Reduced Functionality Mode
Answer: A
Explanation:
The Mac Sensor report is a pre-defined report that provides a summary view of selected activities on Mac hosts. It shows information such as process execution events, network connection events, file write events, etc. that occurred on Mac hosts within a specified time range. The Mac Sensor report does not identify endpoints that are in Reduced Functionality Mode, provide vulnerability assessment for Mac Operating Systems, or provide a dashboard for Mac related detections.
NEW QUESTION # 26
Which document provides information on best practices for writing Splunk-based hunting queries, predefined queries which may be customized to hunt for suspicious network connections, and predefined queries which may be customized to hunt for suspicious processes?
- A. Hunting and Investigation
- B. Events Data Dictionary
- C. Incident and Detection Monitoring
- D. Real Time Response and Network Containment
Answer: A
Explanation:
The Hunting and Investigation document provides information on best practices for writing Splunk-based hunting queries, predefined queries which may be customized to hunt for suspicious network connections, and predefined queries which may be customized to hunt for suspicious processes. As explained above, the Hunting and Investigation document is a guide that provides sample hunting queries, select walkthroughs, and best practices for hunting with Falcon. The other documents do not provide the same information.
NEW QUESTION # 27
What is the difference between a Host Search and a Host Timeline?
- A. There is no difference. You just get to them different ways
- B. A Host Search organizes the data in useful event categories like process executions and network connections, a Host Timeline provides an uncategorized view of recorded events in chronological order
- C. Host Search is used for detection investigation and Host Timeline is used for proactive hunting
- D. You access a Host Search from a detection to show you every recorded process event related to the detection and you can only populate the Host Timeline fields manually
Answer: B
Explanation:
This is the difference between a Host Search and a Host Timeline. A Host Search is an Investigate tool that allows you to view events by category, such as process executions, network connections, file writes, etc. A Host Timeline is an Investigate tool that allows you to view all events in chronological order, without any categorization. Both tools can be used for detection investigation and proactive hunting, depending on the use case and preference. You can access a Host Search from a detection or manually enter the host details. You can also populate the Host Timeline fields manually or from other pages in Falcon.
NEW QUESTION # 28
Which SPL (Splunk) field name can be used to automatically convert Unix times (Epoch) to UTC readable time within the Flacon Event Search?
- A. time
- B. utc_time
- C. _time
- D. conv_time
Answer: C
Explanation:
_time is the SPL (Splunk) field name that can be used to automatically convert Unix times (Epoch) to UTC readable time within the Falcon Event Search. It is a default field that shows the timestamp of each event in a human-readable format. utc_time, conv_time, and time are not valid SPL field names for converting Unix times to UTC readable time.
NEW QUESTION # 29
The help desk is reporting an increase in calls related to user accounts being locked out over the last few days. You suspect that this could be an attack by an adversary against your organization. Select the best hunting hypothesis from the following:
- A. A password guessing attack is being executed against remote access mechanisms such as VPN
- B. A publicly available web application has been hacked and is causing the lockouts
- C. Users are locking their accounts out because they recently changed their passwords
- D. A zero-day vulnerability is being exploited on a Microsoft Exchange server
Answer: A
Explanation:
A hunting hypothesis is a statement that describes a possible malicious activity that can be tested with data and analysis. A good hunting hypothesis should be specific, testable, and relevant to the problem or goal. In this case, the best hunting hypothesis from the following is that a password guessing attack is being executed against remote access mechanisms such as VPN, as it explains the possible cause and method of the user account lockouts in a specific and testable way. A zero-day vulnerability on a Microsoft Exchange server is too vague and does not explain how it relates to the lockouts. A hacked web application is also too vague and does not specify how it causes the lockouts. Users locking their accounts out because they recently changed their passwords is not a malicious activity and does not account for the increase in calls.
NEW QUESTION # 30
Lateral movement through a victim environment is an example of which stage of the Cyber Kill Chain?
- A. Delivery
- B. Command & Control
- C. Actions on Objectives
- D. Exploitation
Answer: B
Explanation:
Lateral movement through a victim environment is an example of the Command & Control stage of the Cyber Kill Chain. The Cyber Kill Chain is a model that describes the phases of a cyber attack, from reconnaissance to actions on objectives. The Command & Control stage is where the adversary establishes and maintains communication with the compromised systems and moves laterally to expand their access and control.
NEW QUESTION # 31
How do you rename fields while using transforming commands such as table, chart, and stats?
- A. By specifying the desired name after the field name eg "stats count totalcount by ComputerName"
- B. By renaming the fields with the "rename" command after the transforming command e.g. "stats count by ComputerName | rename count AS total_count"
- C. You cannot rename fields as it would affect sub-queries and statistical analysis
- D. By using the "renamed" keyword after the field name eg "stats count renamed totalcount by ComputerName"
Answer: B
Explanation:
The rename command is used to rename fields while using transforming commands such as table, chart, and stats. It can be used after the transforming command and specify the old and new field names with the AS keyword. You can rename fields as it would not affect sub-queries and statistical analysis, as long as you use the correct field names in your queries. The renamed keyword and the desired name after the field name are not valid ways to rename fields.
NEW QUESTION # 32
Which of the following is a way to create event searches that run automatically and recur on a schedule that you set?
- A. Workflows
- B. Scheduled Reports
- C. Scheduled Searches
- D. Event Search
Answer: C
Explanation:
Scheduled Searches are a way to create event searches that run automatically and recur on a schedule that you set. You can use Scheduled Searches to monitor your environment for specific conditions or patterns, generate reports or alerts, or enrich your data with additional fields or tags. Workflows, Event Search, and Scheduled Reports are not ways to create event searches that run automatically and recur on a schedule.
NEW QUESTION # 33
Event Search data is recorded with which time zone?
- A. EST
- B. GMT
- C. UTC
- D. PST
Answer: C
Explanation:
Event Search data is recorded with UTC (Coordinated Universal Time) time zone. UTC is a standard time zone that is used as a reference point for other time zones. PST (Pacific Standard Time), GMT (Greenwich Mean Time), and EST (Eastern Standard Time) are not the time zones that Event Search data is recorded with.
NEW QUESTION # 34
Which of the following Event Search queries would only find the DNS lookups to the domain: www randomdomain com?
- A. ComputerName=localhost DnsRequest "randomdomain com"
- B. event_simpleName=DnsRequest DomainName=www randomdomain com
- C. event_simpleName=DnsRequest DomainName=randomdomain com ComputerName=localhost
- D. Dns=randomdomain com
Answer: B
Explanation:
This Event Search query would only find the DNS lookups to the domain www randomdomain com, as it specifies the exact event type and domain name to match. The other queries would either find other events or domains that are not relevant to the question.
NEW QUESTION # 35
To find events that are outliers inside a network,___________is the best hunting method to use.
- A. stacking
- B. time-based
- C. machine learning
- D. searching
Answer: A
Explanation:
Stacking (Frequency Analysis) is the best hunting method to use to find events that are outliers inside a network. Stacking involves grouping events by a common attribute and counting their frequency, then sorting them by ascending or descending order to identify rare or common events. This can help find anomalies or deviations from normal behavior that could indicate malicious activity. Time-based searching, machine learning, and searching are not specific hunting methods to find outliers.
NEW QUESTION # 36
......
CrowdStrike CCFH-202 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
Share Latest CCFH-202 DUMP Questions and Answers: https://www.itexamsimulator.com/CCFH-202-brain-dumps.html
CCFH-202 Questions and Answers Guarantee you Oass the Test Easily: https://drive.google.com/open?id=12kwDrQtySw8pUA-MUxDkOTd2YAf_dDAs
