Feb 29, 2024 CCFH-202 Exam Crack Test Engine Dumps Training With 62 Questions
Obtain the CCFH-202 PDF Dumps Get 100% Outcomes Exam Questions For You To Pass
CrowdStrike CCFH-202 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
| Topic 6 |
|
NEW QUESTION # 18
Which SPL (Splunk) field name can be used to automatically convert Unix times (Epoch) to UTC readable time within the Flacon Event Search?
- A. time
- B. _time
- C. utc_time
- D. conv_time
Answer: B
Explanation:
_time is the SPL (Splunk) field name that can be used to automatically convert Unix times (Epoch) to UTC readable time within the Falcon Event Search. It is a default field that shows the timestamp of each event in a human-readable format. utc_time, conv_time, and time are not valid SPL field names for converting Unix times to UTC readable time.
NEW QUESTION # 19
Which tool allows a threat hunter to populate and colorize all known adversary techniques in a single view?
- A. OWASP Threat Dragon
- B. MITRE ATT&CK Navigator
- C. OpenXDR
- D. MISP
Answer: B
Explanation:
MITRE ATT&CK Navigator is a tool that allows a threat hunter to populate and colorize all known adversary techniques in a single view. It is based on the MITRE ATT&CK framework, which is a knowledge base of adversary behaviors and tactics. The tool enables threat hunters to create custom matrices, layers, annotations, and filters to explore and model specific adversary techniques, with links to intelligence and case studies.
NEW QUESTION # 20
Which of the following is TRUE about a Hash Search?
- A. The Hash Search provides Process Execution History
- B. Module Load History is not presented in a Hash Search
- C. Wildcard searches are not permitted with the Hash Search
- D. The Hash Search is available on Linux
Answer: A
Explanation:
The Hash Search is an Investigate tool that allows you to search for a file hash and view its process execution history across all hosts in your environment. It shows information such as process name, command line, parent process name, parent command line, etc. for each execution of the file hash. Wildcard searches are permitted with the Hash Search, as long as they are at least four characters long. The Hash Search is available on Linux, as well as Windows and Mac OS X. Module Load History is presented in a Hash Search, along with other information such as File Write History and Detection History.
NEW QUESTION # 21
You would like to search for ANY process execution that used a file stored in the Recycle Bin on a Windows host. Select the option to complete the following EAM query.
- A. ^$Recycle.Bin%^
- B. ^$Recycle Bin*
- C. *$Recycle Bin^
- D. *$Recycle Bin*
Answer: D
Explanation:
This option is the correct one to complete the following EAM query:
event_simpleName=ProcessRollup2 FileName=$Recycle Bin
This query would search for any process execution that used a file stored in the Recycle Bin on a Windows host, as the asterisk (*) is a wildcard character that matches any number of characters before or after the specified string. The other options are not correct, as they use different wildcard characters that do not match the desired pattern.
NEW QUESTION # 22
SPL (Splunk) eval statements can be used to convert Unix times (Epoch) into UTC readable time Which eval function is correct^
- A. relative time
- B. strftime
- C. typeof
- D. now
Answer: B
Explanation:
The strftime eval function is used to convert Unix times (Epoch) into UTC readable time. It takes two arguments: a Unix time field and a format string that specifies how to display the time. The now, typeof, and relative_time eval functions are not used to convert Unix times into UTC readable time.
NEW QUESTION # 23
What is the main purpose of the Mac Sensor report?
- A. To provide a dashboard for Mac related detections
- B. To provide vulnerability assessment for Mac Operating Systems
- C. To provide a summary view of selected activities on Mac hosts
- D. To identify endpoints that are in Reduced Functionality Mode
Answer: C
Explanation:
The Mac Sensor report is a pre-defined report that provides a summary view of selected activities on Mac hosts. It shows information such as process execution events, network connection events, file write events, etc. that occurred on Mac hosts within a specified time range. The Mac Sensor report does not identify endpoints that are in Reduced Functionality Mode, provide vulnerability assessment for Mac Operating Systems, or provide a dashboard for Mac related detections.
NEW QUESTION # 24
How do you rename fields while using transforming commands such as table, chart, and stats?
- A. By specifying the desired name after the field name eg "stats count totalcount by ComputerName"
- B. By using the "renamed" keyword after the field name eg "stats count renamed totalcount by ComputerName"
- C. By renaming the fields with the "rename" command after the transforming command e.g. "stats count by ComputerName | rename count AS total_count"
- D. You cannot rename fields as it would affect sub-queries and statistical analysis
Answer: C
Explanation:
The rename command is used to rename fields while using transforming commands such as table, chart, and stats. It can be used after the transforming command and specify the old and new field names with the AS keyword. You can rename fields as it would not affect sub-queries and statistical analysis, as long as you use the correct field names in your queries. The renamed keyword and the desired name after the field name are not valid ways to rename fields.
NEW QUESTION # 25
To find events that are outliers inside a network,___________is the best hunting method to use.
- A. stacking
- B. searching
- C. time-based
- D. machine learning
Answer: A
Explanation:
Stacking (Frequency Analysis) is the best hunting method to use to find events that are outliers inside a network. Stacking involves grouping events by a common attribute and counting their frequency, then sorting them by ascending or descending order to identify rare or common events. This can help find anomalies or deviations from normal behavior that could indicate malicious activity. Time-based searching, machine learning, and searching are not specific hunting methods to find outliers.
NEW QUESTION # 26
Which of the following is the proper method to quantify search results, enabling a hunter to quickly sort and identify outliers?
- A. Using the "|stats count" command at the end of a search string in Event Search
- B. Using the "| stats count by" command at the end of a search string in Event Search
- C. Using the "|eval" command at the end of a search string in Event Search
- D. Exporting Event Search results to a spreadsheet and aggregating the results
Answer: B
Explanation:
This is the proper method to quantify search results, enabling a hunter to quickly sort and identify outliers. The stats command is used to calculate summary statistics on the results of a search or subsearch, such as count, sum, average, etc. The count by option is used to count the number of events for each distinct value of a field or fields and display them in a table. This can help find rare or common values that could indicate anomalies or deviations from normal behavior.
NEW QUESTION # 27
In which of the following stages of the Cyber Kill Chain does the actor not interact with the victim endpoint(s)?
- A. Exploitation
- B. Weaponization
- C. Installation
- D. Command & control
Answer: B
Explanation:
Weaponization is the stage of the Cyber Kill Chain where the actor does not interact with the victim endpoint(s). Weaponization is where the actor prepares or packages the exploit or payload that will be used to compromise the target. This stage does not involve any communication or interaction with the victim endpoint(s), as it is done by the actor before delivering the weaponized content. Exploitation, Command & Control, and Installation are all stages where the actor interacts with the victim endpoint(s), either by executing code, establishing communication, or installing malware.
NEW QUESTION # 28
Which field in a DNS Request event points to the responsible process?
- A. ContextProcessld_readable
- B. ContextProcessld_decimal
- C. TargetProcessld_decimal
- D. ParentProcessId_decimal
Answer: A
Explanation:
The ContextProcessld_readable field in a DNS Request event points to the responsible process. The ContextProcessld_readable field is the readable representation of the process identifier for the process that initiated the DNS request. It can be used to identify which process was communicating with a specific domain or IP address. The TargetProcessld_decimal, ContextProcessld_decimal, and ParentProcessId_decimal fields do not point to the responsible process.
NEW QUESTION # 29
Which of the following is a suspicious process behavior?
- A. PowerShell launching a PowerShell script
- B. Non-network processes (eg, notepad exe) making an outbound network connection
- C. An Internet browser (eg, Internet Explorer) performing multiple DNS requests
- D. PowerShell running an execution policy of RemoteSigned
Answer: B
Explanation:
Non-network processes are processes that are not expected to communicate over the network, such as notepad.exe. If they make an outbound network connection, it could indicate that they are compromised or maliciously used by an adversary. PowerShell running an execution policy of RemoteSigned is a default setting that allows local scripts to run without digital signatures. An Internet browser performing multiple DNS requests is a normal behavior for web browsing. PowerShell launching a PowerShell script is also a common behavior for legitimate tasks.
NEW QUESTION # 30
To view Files Written to Removable Media within a specified timeframe on a host within the Host Search page, expand and refer to the _______dashboard panel.
- A. Processes and Services
- B. Command Line and Admin Tools
- C. Suspicious File Activity
- D. Registry, Tasks, and Firewall
Answer: C
Explanation:
To view Files Written to Removable Media within a specified timeframe on a host within the Host Search page, you need to expand and refer to the Suspicious File Activity dashboard panel. The Suspicious File Activity dashboard panel shows information such as files written to removable media, files written to system directories by non-system processes, files written to startup folders, etc. The other dashboard panels do not show files written to removable media.
NEW QUESTION # 31
What topics are presented in the Hunting and Investigation Guide?
- A. Recommended platform configurations and prevention settings to ensure detections are generated for hunting leads
- B. Sample hunting queries, select walkthroughs and best practices for hunting with Falcon
- C. Detailed tutorial on writing advanced queries such as sub-searches and joins
- D. Detailed summary of event names, descriptions, and some key data fields for hunting and investigation
Answer: B
Explanation:
This is the correct answer for the same reason as above. The Hunting and Investigation guide provides sample hunting queries, select walkthroughs, and best practices for hunting with Falcon. It does not provide a detailed tutorial on writing advanced queries, a detailed summary of event names and descriptions, or recommended platform configurations and prevention settings.
NEW QUESTION # 32
What do you click to jump to a Process Timeline from many pages in Falcon, such as a Hash Search?
- A. Process Timeline Link
- B. CID
- C. PID
- D. Process ID or Parent Process ID
Answer: A
Explanation:
The Process Timeline Link is what you click to jump to a Process Timeline from many pages in Falcon, such as a Hash Search. The Process Timeline Link is an icon that looks like three horizontal bars with dots on them. It appears next to each process name or ID on various pages in Falcon, such as Hash Search results, Detection details, Event Search results, etc. Clicking on it will open a new tab with the Process Timeline for that process. The PID, the Process ID or Parent Process ID, and the CID are not what you click to jump to a Process Timeline.
NEW QUESTION # 33
Which Falcon documentation guide should you reference to hunt for anomalies related to scheduled tasks and other Windows related artifacts?
- A. Customizable Dashboards
- B. MITRE-Based Falcon Detections Framework
- C. Events Data Dictionary
- D. Hunting and Investigation
Answer: D
Explanation:
The Hunting and Investigation guide is the Falcon documentation guide that you should reference to hunt for anomalies related to scheduled tasks and other Windows related artifacts. The Hunting and Investigation guide provides sample hunting queries, select walkthroughs, and best practices for hunting with Falcon. It covers various topics such as process execution, network connections, registry activity, scheduled tasks, and more.
NEW QUESTION # 34
Which Falcon documentation guide should you reference to hunt for anomalies related to scheduled tasks and other Windows related artifacts?
- A. Customizable Dashboards
- B. MITRE-Based Falcon Detections Framework
- C. Events Data Dictionary
- D. Hunting and Investigation
Answer: D
Explanation:
The Hunting and Investigation guide is the Falcon documentation guide that you should reference to hunt for anomalies related to scheduled tasks and other Windows related artifacts. The Hunting and Investigation guide provides sample hunting queries, select walkthroughs, and best practices for hunting with Falcon. It covers various topics such as process execution, network connections, registry activity, scheduled tasks, and more.
NEW QUESTION # 35
......
CCFH-202 Exam Dumps Contains FREE Real Quesions from the Actual Exam: https://www.exam4free.com/CCFH-202-valid-dumps.html
Free Test Engine Verified By CrowdStrike Certified Falcon Hunter Certified Experts: https://drive.google.com/open?id=1eKCpc44Lm66pNNQI-UKivl-sT-Am_B7G
