CrowdStrike Certified Falcon Hunter - CCFH-202b Exam Questions
QUESTION NO: 1
A benefit of using a threat hunting framework is that it:
A benefit of using a threat hunting framework is that it:
Correct Answer: B
Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).
QUESTION NO: 2
Which document provides information on best practices for writing Splunk-based hunting queries, predefined queries which may be customized to hunt for suspicious network connections, and predefined queries which may be customized to hunt for suspicious processes?
Which document provides information on best practices for writing Splunk-based hunting queries, predefined queries which may be customized to hunt for suspicious network connections, and predefined queries which may be customized to hunt for suspicious processes?
Correct Answer: B
Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).
QUESTION NO: 3
Which of the following is the proper method to quantify search results, enabling a hunter to quickly sort and identify outliers?
Which of the following is the proper method to quantify search results, enabling a hunter to quickly sort and identify outliers?
Correct Answer: D
Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).
QUESTION NO: 4
Which tool allows a threat hunter to populate and colorize all known adversary techniques in a single view?
Which tool allows a threat hunter to populate and colorize all known adversary techniques in a single view?
Correct Answer: C
Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).
QUESTION NO: 5
What Search page would help a threat hunter differentiate testing, DevOPs, or general user activity from adversary behavior?
What Search page would help a threat hunter differentiate testing, DevOPs, or general user activity from adversary behavior?
Correct Answer: B
Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).
QUESTION NO: 6
The Events Data Dictionary found in the Falcon documentation is useful for writing hunting queries because:
The Events Data Dictionary found in the Falcon documentation is useful for writing hunting queries because:
Correct Answer: A
Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).
QUESTION NO: 7
Which of the following is TRUE about a Hash Search?
Which of the following is TRUE about a Hash Search?
Correct Answer: C
Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).
