CrowdStrike CCFH-202 Exam Prep Guide Prep guide for the CCFH-202 Exam [Q35-Q53]

Q35. Refer to Exhibit.

What type of attack would this process tree indicate?

Q36. How do you rename fields while using transforming commands such as table, chart, and stats?

Q37. You need details about key data fields and sensor events which you may expect to find from Hosts running the Falcon sensor. Which documentation should you access?

Q38. The Process Timeline Events Details table will populate the Parent Process ID and the Parent File columns when the cloudable Event data contains which event field?

Q39. Adversaries commonly execute discovery commands such as netexe, ipconfig.exe, and whoami exe. Rather than query for each of these commands individually, you would like to use a single query with all of them. What Splunk operator is needed to complete the following query?

Q40. The Events Data Dictionary found in the Falcon documentation is useful for writing hunting queries because:

Q41. What is the main purpose of the Mac Sensor report?

Q42. Which of the following best describes the purpose of the Mac Sensor report?

Q43. Which of the following is TRUE about a Hash Search?

Q44. Which Falcon documentation guide should you reference to hunt for anomalies related to scheduled tasks and other Windows related artifacts?

Q45. What information is provided from the MITRE ATT&CK framework in a detection’s Execution Details?

Q46. Which document provides information on best practices for writing Splunk-based hunting queries, predefined queries which may be customized to hunt for suspicious network connections, and predefined queries which may be customized to hunt for suspicious processes?

Q47. When exporting the results of the following event search, what data is saved in the exported file (assuming Verbose Mode)? event_simpleName=*Written | stats count by ComputerName

Q48. Which of the following is an example of actor actions during the RECONNAISSANCE phase of the Cyber Kill Chain?

Q49. In the MITRE ATT&CK Framework (version 11 – the newest version released in April 2022), which of the following pair of tactics is not in the Enterprise: Windows matrix?

Q50. Which of the following is the proper method to quantify search results, enabling a hunter to quickly sort and identify outliers?

Q51. Which pre-defined reports offer information surrounding activities that typically indicate suspicious activity occurring on a system?

Q52. SPL (Splunk) eval statements can be used to convert Unix times (Epoch) into UTC readable time Which eval function is correct^

Q53. To find events that are outliers inside a network,___________is the best hunting method to use.