CCFH-202 Actual Questions – Instant Download 62 Questions [Q32-Q51]

QUESTION 32
Which of the following does the Hunting and Investigation Guide contain?

QUESTION 33
An analyst has sorted all recent detections in the Falcon platform to identify the oldest in an effort to determine the possible first victim host What is this type of analysis called?

QUESTION 34
You need details about key data fields and sensor events which you may expect to find from Hosts running the Falcon sensor. Which documentation should you access?

QUESTION 35
Which structured analytic technique contrasts different hypotheses to determine which is the best leading (prioritized) hypothesis?

QUESTION 36
Which of the following is an example of a Falcon threat hunting lead?

QUESTION 37
Which Falcon documentation guide should you reference to hunt for anomalies related to scheduled tasks and other Windows related artifacts?

QUESTION 38
Which of the following would be the correct field name to find the name of an event?

QUESTION 39
The Events Data Dictionary found in the Falcon documentation is useful for writing hunting queries because:

QUESTION 40
The Falcon Detections page will attempt to decode Encoded PowerShell Command line parameters when which PowerShell Command line parameter is present?

QUESTION 41
SPL (Splunk) eval statements can be used to convert Unix times (Epoch) into UTC readable time Which eval function is correct^

QUESTION 42
What information is shown in Host Search?

QUESTION 43
In the MITRE ATT&CK Framework (version 11 – the newest version released in April 2022), which of the following pair of tactics is not in the Enterprise: Windows matrix?

QUESTION 44
Where would an analyst find information about shells spawned by root, Kernel Module loads, and wget/curl usage?

QUESTION 45
Which pre-defined reports offer information surrounding activities that typically indicate suspicious activity occurring on a system?

QUESTION 46
In which of the following stages of the Cyber Kill Chain does the actor not interact with the victim endpoint(s)?

QUESTION 47
Which of the following is the proper method to quantify search results, enabling a hunter to quickly sort and identify outliers?

QUESTION 48
When performing a raw event search via the Events search page, what are Event Actions?

QUESTION 49
You would like to search for ANY process execution that used a file stored in the Recycle Bin on a Windows host. Select the option to complete the following EAM query.

QUESTION 50
You are reviewing a list of domains recently banned by your organization’s acceptable use policy. In particular, you are looking for the number of hosts that have visited each domain. Which tool should you use in Falcon?

QUESTION 51
Which SPL (Splunk) field name can be used to automatically convert Unix times (Epoch) to UTC readable time within the Flacon Event Search?