Steps Necessary To Pass The CCFH-202b Exam from Training Expert ExamDumpsVCE [Q11-Q34]

Rate this post

Steps Necessary To Pass The CCFH-202b Exam from Training Expert ExamDumpsVCE

Valid Way To Pass CrowdStrike Falcon Certification Program’s CCFH-202b Exam

CrowdStrike CCFH-202b Exam Syllabus Topics:

Topic	Details
Topic 1	Hunting Analytics: This domain focuses on recognizing malicious behaviors, evaluating information reliability, decoding command line activity, identifying infection patterns, distinguishing legitimate from adversary activity, and identifying exploited vulnerabilities.
Topic 2	Event Search: This domain focuses on using CrowdStrike Query Language to build queries, format and filter event data, understand process relationships and event types, and create custom dashboards.
Topic 3	Hunting Methodology: This domain covers conducting active hunts, performing outlier analysis, testing hunting hypotheses, constructing queries, and investigating process trees.
Topic 4	ATT&CK Frameworks: This domain covers understanding the cyber kill chain and using the MITRE ATT&CK Framework to model threat actor behaviors and communicate findings to non-technical audiences.
Topic 5	Search and Investigation Tools: This domain covers analyzing file and process metadata, using Investigate Module tools, performing various searches, and interpreting dashboard results.
Topic 6	Reports and References: This domain covers using built-in Hunt and Visibility reports and leveraging Events Full Reference documentation for event information.

NO.11 What is the main purpose of the Mac Sensor report?

To identify endpoints that are in Reduced Functionality Mode

To provide a summary view of selected activities on Mac hosts

To provide vulnerability assessment for Mac Operating Systems

To provide a dashboard for Mac related detections

NO.12 You would like to search for ANY process execution that used a file stored in the Recycle Bin on a Windows host. Select the option to complete the following EAM query.

*$Recycle Bin^

*$Recycle Bin*

^$Recycle Bin*

^$Recycle.Bin%^

NO.13 The Events Data Dictionary found in the Falcon documentation is useful for writing hunting queries because:

It provides pre-defined queries you can customize to meet your specific threat hunting needs

It provides a list of all the detect names and descriptions found in the Falcon Cloud

It provides a reference of information about the events found in the Investigate > Event Search page of the Falcon Console

It provides a list of compatible splunk commands used to query event data

NO.14 In the MITRE ATT&CK Framework (version 11 – the newest version released in April 2022), which of the following pair of tactics is not in the Enterprise: Windows matrix?

Persistence and Execution

Impact and Collection

Privilege Escalation and Initial Access

Reconnaissance and Resource Development

NO.15 When exporting the results of the following event search, what data is saved in the exported file (assuming Verbose Mode)? event_simpleName=*Written | stats count by ComputerName

The text of the query

The results of the Statistics tab

No data Results can only be exported when the “table” command is used

All events in the Events tab

NO.16 What information is provided when using IP Search to look up an IP address?

Suspicious IP addresses

External IPs only

Internal IPs only

Both internal and external IPs

NO.17 What information is provided when using IP Search to look up an IP address?

Both internal and external IPs

Suspicious IP addresses

External IPs only

Internal IPs only

NO.18 Which of the following is an example of actor actions during the RECONNAISSANCE phase of the Cyber Kill Chain?

Installing a backdoor on the victim endpoint

Discovering internet-facing servers

Emailing the intended victim with a malware attachment

Loading a malicious payload into a common DLL

NO.19 In which of the following stages of the Cyber Kill Chain does the actor not interact with the victim endpoint(s)?

Exploitation

Weaponization

Command & control

Installation

NO.20 When performing a raw event search via the Events search page, what are Event Actions?

Event Actions contains an audit information log of actions an analyst took in regards to a specific detection

Event Actions contains the summary of actions taken by the Falcon sensor such as quarantining a file, prevent a process from executing or taking no actions and creating a detection only

Event Actions are pivotable workflows including connecting to a host, pre-made event searches and pivots to other investigatory pages such as host search

Event Actions is the field name that contains the event name defined in the Events Data Dictionary such as ProcessRollup, SyntheticProcessRollup, DNS request, etc

NO.21 What information is shown in Host Search?

Quarantined Files

Prevention Policies

Intel Reports

Processes and Services

NO.22 How do you rename fields while using transforming commands such as table, chart, and stats?

By renaming the fields with the “rename” command after the transforming command e.g. “stats count by ComputerName | rename count AS total_count”

You cannot rename fields as it would affect sub-queries and statistical analysis

By using the “renamed” keyword after the field name eg “stats count renamed totalcount by ComputerName”

By specifying the desired name after the field name eg “stats count totalcount by ComputerName”

NO.23 Lateral movement through a victim environment is an example of which stage of the Cyber Kill Chain?

Command & Control

Actions on Objectives

Exploitation

Delivery

NO.24 Which of the following is the proper method to quantify search results, enabling a hunter to quickly sort and identify outliers?

Using the “| stats count by” command at the end of a search string in Event Search

Using the “|stats count” command at the end of a search string in Event Search

Using the “|eval” command at the end of a search string in Event Search

Exporting Event Search results to a spreadsheet and aggregating the results

NO.25 Which of the following queries will return the parent processes responsible for launching badprogram exe?

[search (ParentProcess) where name=badprogranrexe ] | table ParentProcessName _time

event_simpleName=processrollup2 [search event_simpleName=processrollup2 FileName=badprogram.exe | rename ParentProcessld_decimal AS TargetProcessld_decimal | fields aid TargetProcessld_decimal] | stats count by FileName _time

[search (ProcessList) where Name=badprogram.exe ] | search ParentProcessName | table ParentProcessName _time

event_simpleName=processrollup2 [search event_simpleName=processrollup2 FileName=badprogram.exe | rename TargetProcessld_decimal AS ParentProcessld_decimal | fields aid TargetProcessld_decimal] | stats count by FileName _time

NO.26 Which of the following is an example of a Falcon threat hunting lead?

A routine threat hunt query showing process executions of single letter filename (e.g., a.exe) from temporary directories

Security appliance logs showing potentially bad traffic to an unknown external IP address

A help desk ticket for a user clicking on a link in an email causing their machine to become unresponsive and have high CPU usage

An external report describing a unique 5 character file extension for ransomware encrypted files

NO.27 You need details about key data fields and sensor events which you may expect to find from Hosts running the Falcon sensor. Which documentation should you access?

Events Data Dictionary

Streaming API Event Dictionary

Hunting and Investigation

Event stream APIs

NO.28 Which tool allows a threat hunter to populate and colorize all known adversary techniques in a single view?

MISP

OWASP Threat Dragon

OpenXDR

MITRE ATT&CK Navigator

NO.29 Which of the following does the Hunting and Investigation Guide contain?

A list of all event types and their syntax

A list of all event types specifically used for hunting and their syntax

Example Event Search queries useful for threat hunting

Example Event Search queries useful for Falcon platform configuration

NO.30 What information is provided from the MITRE ATT&CK framework in a detection’s Execution Details?

Grouping Tag

Command Line

Technique ID

Triggering Indicator

NO.31 In the Powershell Hunt report, what does the filtering condition of commandLine! =”*badstring* ” do?

Prevents command lines containing “badstring” from being displayed

Displays only the command lines containing “badstring”

Highlights “badstring” in all command lines in the output

Highlights only the command lines containing “badstring”

NO.32 Which structured analytic technique contrasts different hypotheses to determine which is the best leading (prioritized) hypothesis?

Model hunting framework

Competitive analysis

Analysis of competing hypotheses

Key assumptions check

NO.33 Which pre-defined reports offer information surrounding activities that typically indicate suspicious activity occurring on a system?

Scheduled searches

Hunt reports

Sensor reports

Timeline reports

NO.34 You want to produce a list of all event occurrences along with selected fields such as the full path, time, username etc. Which command would be the appropriate choice?

fields

distinct count

table

values