[Dec-2023] CrowdStrike CCFH-202 Dumps – Reduce Your Chance of Failure in CCFH-202 Exam [Q11-Q26]

4/5 - (1 vote)

[Dec-2023] CrowdStrike CCFH-202 Dumps – Reduce Your Chance of Failure in CCFH-202 Exam

To help you achieve your ultimate goal, we suggest the actual CrowdStrike CCFH-202 dumps for your CrowdStrike Certified Falcon Hunter exam preparation to use as your guideline.

QUESTION 11
When performing a raw event search via the Events search page, what are Event Actions?

Event Actions contains an audit information log of actions an analyst took in regards to a specific detection

Event Actions contains the summary of actions taken by the Falcon sensor such as quarantining a file, prevent a process from executing or taking no actions and creating a detection only

Event Actions are pivotable workflows including connecting to a host, pre-made event searches and pivots to other investigatory pages such as host search

Event Actions is the field name that contains the event name defined in the Events Data Dictionary such as ProcessRollup, SyntheticProcessRollup, DNS request, etc

QUESTION 12
You are reviewing a list of domains recently banned by your organization’s acceptable use policy. In particular, you are looking for the number of hosts that have visited each domain. Which tool should you use in Falcon?

Create a custom alert for each domain

Allowed Domain Summary Report

Bulk Domain Search

IP Addresses Search

QUESTION 13
What information is shown in Host Search?

Quarantined Files

Prevention Policies

Intel Reports

Processes and Services

QUESTION 14
The help desk is reporting an increase in calls related to user accounts being locked out over the last few days. You suspect that this could be an attack by an adversary against your organization. Select the best hunting hypothesis from the following:

A zero-day vulnerability is being exploited on a Microsoft Exchange server

A publicly available web application has been hacked and is causing the lockouts

Users are locking their accounts out because they recently changed their passwords

A password guessing attack is being executed against remote access mechanisms such as VPN

QUESTION 15
The Events Data Dictionary found in the Falcon documentation is useful for writing hunting queries because:

It provides pre-defined queries you can customize to meet your specific threat hunting needs

It provides a list of all the detect names and descriptions found in the Falcon Cloud

It provides a reference of information about the events found in the Investigate > Event Search page of the Falcon Console

It provides a list of compatible splunk commands used to query event data

QUESTION 16
Which of the following is TRUE about a Hash Search?

Wildcard searches are not permitted with the Hash Search

The Hash Search provides Process Execution History

The Hash Search is available on Linux

Module Load History is not presented in a Hash Search

QUESTION 17
What elements are required to properly execute a Process Timeline?

Agent ID (AID) and Target Process ID

Agent ID (AID) only

Hostname and Local Process ID

Target Process ID only

QUESTION 18
What Search page would help a threat hunter differentiate testing, DevOPs, or general user activity from adversary behavior?

Hash Search

IP Search

Domain Search

User Search

QUESTION 19
You would like to search for ANY process execution that used a file stored in the Recycle Bin on a Windows host. Select the option to complete the following EAM query.

*$Recycle Bin^

*$Recycle Bin*

^$Recycle Bin*

^$Recycle.Bin%^

QUESTION 20
What information is provided when using IP Search to look up an IP address?

Both internal and external IPs

Suspicious IP addresses

External IPs only

Internal IPs only

QUESTION 21
With Custom Alerts you are able to configure email alerts using predefined templates so you’re notified about specific activity in your environment. Which of the following outlines the steps required to properly create a custom alert rule?

Choose the template you would like to configure, setup how often you would like the alert to run, and then schedule the alert

Choose the template you would like to configure, preview the search results, and then schedule the alert

Create the query for the alert, setup the email template for the alert, and then set the schedule for the alert

Create a new custom template, configure the email template, and then create the custom query for the alert

QUESTION 22
To find events that are outliers inside a network,___________is the best hunting method to use.

time-based

machine learning

searching

stacking

QUESTION 23
Which pre-defined reports offer information surrounding activities that typically indicate suspicious activity occurring on a system?

Scheduled searches

Hunt reports

Sensor reports

Timeline reports

QUESTION 24
What is the main purpose of the Mac Sensor report?

To identify endpoints that are in Reduced Functionality Mode

To provide a summary view of selected activities on Mac hosts

To provide vulnerability assessment for Mac Operating Systems

To provide a dashboard for Mac related detections

QUESTION 25
How do you rename fields while using transforming commands such as table, chart, and stats?

By renaming the fields with the “rename” command after the transforming command e.g. “stats count by ComputerName | rename count AS total_count”

You cannot rename fields as it would affect sub-queries and statistical analysis

By using the “renamed” keyword after the field name eg “stats count renamed totalcount by ComputerName”

By specifying the desired name after the field name eg “stats count totalcount by ComputerName”

QUESTION 26
Which threat framework allows a threat hunter to explore and model specific adversary tactics and techniques, with links to intelligence and case studies?

MITRE ATT&CK

Lockheed Martin Cyber Kill Chain

Director of National Intelligence Cyber Threat Framework

NIST 800-171 Cyber Threat Framework