Download Online VALID CCFH-202 Exam Dumps File Instantly[Nov 20, 2023]
CCFH-202 Exam Dumps For Certification Exam Preparation
NEW QUESTION # 29
Which Falcon documentation guide should you reference to hunt for anomalies related to scheduled tasks and other Windows related artifacts?
- A. Events Data Dictionary
- B. Customizable Dashboards
- C. Hunting and Investigation
- D. MITRE-Based Falcon Detections Framework
Answer: C
Explanation:
The Hunting and Investigation guide is the Falcon documentation guide that you should reference to hunt for anomalies related to scheduled tasks and other Windows related artifacts. The Hunting and Investigation guide provides sample hunting queries, select walkthroughs, and best practices for hunting with Falcon. It covers various topics such as process execution, network connections, registry activity, scheduled tasks, and more.
NEW QUESTION # 30
Where would an analyst find information about shells spawned by root, Kernel Module loads, and wget/curl usage?
- A. Linux Sensor report
- B. Mac Sensor report
- C. Sensor Policy Daily report
- D. Sensor Health report
Answer: A
Explanation:
The Linux Sensor report is where an analyst would find information about shells spawned by root, Kernel Module loads, and wget/curl usage. The Linux Sensor report is a pre-defined report that provides a summary view of selected activities on Linux hosts. It shows information such as process execution events, network connection events, file write events, etc. that occurred on Linux hosts within a specified time range. The Sensor Health report, the Sensor Policy Daily report, and the Mac Sensor report do not provide the same information.
NEW QUESTION # 31
What information is provided from the MITRE ATT&CK framework in a detection's Execution Details?
- A. Technique ID
- B. Command Line
- C. Grouping Tag
- D. Triggering Indicator
Answer: A
Explanation:
Technique ID is the information that is provided from the MITRE ATT&CK framework in a detection's Execution Details. Technique ID is a unique identifier for each technique in the MITRE ATT&CK framework, such as T1059 for Command and Scripting Interpreter or T1566 for Phishing. Technique ID helps to map a detection to a specific adversary behavior and tactic. Grouping Tag, Command Line, and Triggering Indicator are not information that is provided from the MITRE ATT&CK framework in a detection's Execution Details.
NEW QUESTION # 32
In which of the following stages of the Cyber Kill Chain does the actor not interact with the victim endpoint(s)?
- A. Weaponization
- B. Command & control
- C. Installation
- D. Exploitation
Answer: A
Explanation:
Weaponization is the stage of the Cyber Kill Chain where the actor does not interact with the victim endpoint(s). Weaponization is where the actor prepares or packages the exploit or payload that will be used to compromise the target. This stage does not involve any communication or interaction with the victim endpoint(s), as it is done by the actor before delivering the weaponized content. Exploitation, Command & Control, and Installation are all stages where the actor interacts with the victim endpoint(s), either by executing code, establishing communication, or installing malware.
NEW QUESTION # 33
Which tool allows a threat hunter to populate and colorize all known adversary techniques in a single view?
- A. OpenXDR
- B. OWASP Threat Dragon
- C. MISP
- D. MITRE ATT&CK Navigator
Answer: D
Explanation:
MITRE ATT&CK Navigator is a tool that allows a threat hunter to populate and colorize all known adversary techniques in a single view. It is based on the MITRE ATT&CK framework, which is a knowledge base of adversary behaviors and tactics. The tool enables threat hunters to create custom matrices, layers, annotations, and filters to explore and model specific adversary techniques, with links to intelligence and case studies.
NEW QUESTION # 34
Which of the following would be the correct field name to find the name of an event?
- A. Event_SimpleName
- B. EVENT_SIMPLE_NAME
- C. event_simpleName
- D. Event_Simple_Name
Answer: A
Explanation:
Event_SimpleName is the correct field name to find the name of an event in Falcon Event Search. It is a field that shows the simplified name of each event type, such as ProcessRollup2, DnsRequest, or FileDelete. Event_Simple_Name, EVENT_SIMPLE_NAME, and event_simpleName are not valid field names for finding the name of an event.
NEW QUESTION # 35
A benefit of using a threat hunting framework is that it:
- A. Provides actionable, repeatable steps to conduct threat hunting
- B. Automatically generates incident reports
- C. Eliminates false positives
- D. Provides high fidelity threat actor attribution
Answer: A
Explanation:
A threat hunting framework is a methodology that guides threat hunters in planning, executing, and improving their threat hunting activities. A benefit of using a threat hunting framework is that it provides actionable, repeatable steps to conduct threat hunting in a consistent and efficient manner. A threat hunting framework does not automatically generate incident reports, eliminate false positives, or provide high fidelity threat actor attribution, as these are dependent on other factors such as data sources, tools, and analysis skills.
NEW QUESTION # 36
What is the main purpose of the Mac Sensor report?
- A. To provide a dashboard for Mac related detections
- B. To identify endpoints that are in Reduced Functionality Mode
- C. To provide a summary view of selected activities on Mac hosts
- D. To provide vulnerability assessment for Mac Operating Systems
Answer: C
Explanation:
The Mac Sensor report is a pre-defined report that provides a summary view of selected activities on Mac hosts. It shows information such as process execution events, network connection events, file write events, etc. that occurred on Mac hosts within a specified time range. The Mac Sensor report does not identify endpoints that are in Reduced Functionality Mode, provide vulnerability assessment for Mac Operating Systems, or provide a dashboard for Mac related detections.
NEW QUESTION # 37
You need details about key data fields and sensor events which you may expect to find from Hosts running the Falcon sensor. Which documentation should you access?
- A. Hunting and Investigation
- B. Event stream APIs
- C. Events Data Dictionary
- D. Streaming API Event Dictionary
Answer: C
Explanation:
The Events Data Dictionary found in the Falcon documentation is useful for writing hunting queries because it provides a reference of information about the events found in the Investigate > Event Search page of the Falcon Console. The Events Data Dictionary describes each event type, field name, data type, description, and example value that can be used to query and analyze event data. The Streaming API Event Dictionary, Hunting and Investigation, and Event stream APIs are not documentation that provide details about key data fields and sensor events.
NEW QUESTION # 38
Which of the following is a way to create event searches that run automatically and recur on a schedule that you set?
- A. Scheduled Searches
- B. Event Search
- C. Scheduled Reports
- D. Workflows
Answer: A
Explanation:
Scheduled Searches are a way to create event searches that run automatically and recur on a schedule that you set. You can use Scheduled Searches to monitor your environment for specific conditions or patterns, generate reports or alerts, or enrich your data with additional fields or tags. Workflows, Event Search, and Scheduled Reports are not ways to create event searches that run automatically and recur on a schedule.
NEW QUESTION # 39
Which of the following queries will return the parent processes responsible for launching badprogram exe?
- A. event_simpleName=processrollup2 [search event_simpleName=processrollup2 FileName=badprogram.exe | rename ParentProcessld_decimal AS TargetProcessld_decimal | fields aid TargetProcessld_decimal] | stats count by FileName _time
- B. event_simpleName=processrollup2 [search event_simpleName=processrollup2 FileName=badprogram.exe | rename TargetProcessld_decimal AS ParentProcessld_decimal | fields aid TargetProcessld_decimal] | stats count by FileName _time
- C. [search (ParentProcess) where name=badprogranrexe ] | table ParentProcessName _time
- D. [search (ProcessList) where Name=badprogram.exe ] | search ParentProcessName | table ParentProcessName _time
Answer: B
Explanation:
This query will return the parent processes responsible for launching badprogram.exe by using a subsearch to find the processrollup2 events where FileName is badprogram.exe, then renaming the TargetProcessld_decimal field to ParentProcessld_decimal and using it as a filter for the main search, then using stats to count the occurrences of each FileName by _time. The other queries will either not return the parent processes or use incorrect field names or syntax.
NEW QUESTION # 40
SPL (Splunk) eval statements can be used to convert Unix times (Epoch) into UTC readable time Which eval function is correct^
- A. now
- B. relative time
- C. typeof
- D. strftime
Answer: D
Explanation:
The strftime eval function is used to convert Unix times (Epoch) into UTC readable time. It takes two arguments: a Unix time field and a format string that specifies how to display the time. The now, typeof, and relative_time eval functions are not used to convert Unix times into UTC readable time.
NEW QUESTION # 41
To view Files Written to Removable Media within a specified timeframe on a host within the Host Search page, expand and refer to the _______dashboard panel.
- A. Suspicious File Activity
- B. Command Line and Admin Tools
- C. Processes and Services
- D. Registry, Tasks, and Firewall
Answer: A
Explanation:
To view Files Written to Removable Media within a specified timeframe on a host within the Host Search page, you need to expand and refer to the Suspicious File Activity dashboard panel. The Suspicious File Activity dashboard panel shows information such as files written to removable media, files written to system directories by non-system processes, files written to startup folders, etc. The other dashboard panels do not show files written to removable media.
NEW QUESTION # 42
SPL (Splunk) eval statements can be used to convert Unix times (Epoch) into UTC readable time Which eval function is correct^
- A. now
- B. relative time
- C. typeof
- D. strftime
Answer: D
Explanation:
The strftime eval function is used to convert Unix times (Epoch) into UTC readable time. It takes two arguments: a Unix time field and a format string that specifies how to display the time. The now, typeof, and relative_time eval functions are not used to convert Unix times into UTC readable time.
NEW QUESTION # 43
You would like to search for ANY process execution that used a file stored in the Recycle Bin on a Windows host. Select the option to complete the following EAM query.
- A. ^$Recycle Bin*
- B. *$Recycle Bin*
- C. *$Recycle Bin^
- D. ^$Recycle.Bin%^
Answer: B
Explanation:
This option is the correct one to complete the following EAM query:
event_simpleName=ProcessRollup2 FileName=$Recycle Bin
This query would search for any process execution that used a file stored in the Recycle Bin on a Windows host, as the asterisk (*) is a wildcard character that matches any number of characters before or after the specified string. The other options are not correct, as they use different wildcard characters that do not match the desired pattern.
NEW QUESTION # 44
Which SPL (Splunk) field name can be used to automatically convert Unix times (Epoch) to UTC readable time within the Flacon Event Search?
- A. time
- B. conv_time
- C. _time
- D. utc_time
Answer: C
Explanation:
_time is the SPL (Splunk) field name that can be used to automatically convert Unix times (Epoch) to UTC readable time within the Falcon Event Search. It is a default field that shows the timestamp of each event in a human-readable format. utc_time, conv_time, and time are not valid SPL field names for converting Unix times to UTC readable time.
NEW QUESTION # 45
You are reviewing a list of domains recently banned by your organization's acceptable use policy. In particular, you are looking for the number of hosts that have visited each domain. Which tool should you use in Falcon?
- A. IP Addresses Search
- B. Allowed Domain Summary Report
- C. Create a custom alert for each domain
- D. Bulk Domain Search
Answer: D
Explanation:
Bulk Domain Search is the tool that you should use in Falcon to review a list of domains recently banned by your organization's acceptable use policy and look for the number of hosts that have visited each domain. Bulk Domain Search is an Investigate tool that allows you to search for multiple domains at once and view their network connection events across all hosts in your environment. It shows information such as domain name, number of hosts visited, number of detections generated, etc. for each domain. Create a custom alert for each domain, Allowed Domain Summary Report, and IP Addresses Search are not tools that you should use for this purpose.
NEW QUESTION # 46
What do you click to jump to a Process Timeline from many pages in Falcon, such as a Hash Search?
- A. CID
- B. Process Timeline Link
- C. Process ID or Parent Process ID
- D. PID
Answer: B
Explanation:
The Process Timeline Link is what you click to jump to a Process Timeline from many pages in Falcon, such as a Hash Search. The Process Timeline Link is an icon that looks like three horizontal bars with dots on them. It appears next to each process name or ID on various pages in Falcon, such as Hash Search results, Detection details, Event Search results, etc. Clicking on it will open a new tab with the Process Timeline for that process. The PID, the Process ID or Parent Process ID, and the CID are not what you click to jump to a Process Timeline.
NEW QUESTION # 47
What kind of activity does a User Search help you investigate?
- A. A list of DNS queries by the specified user account
- B. A count of failed user logon activity
- C. A list of process activity executed by the specified user account
- D. A history of Falcon Ul logon activity
Answer: C
Explanation:
User Search is an Investigate tool that helps you investigate a list of process activity executed by the specified user account. It shows information such as process name, command line, parent process name, parent command line, etc. for each process that was executed by the user account on any host in your environment. It does not show a history of Falcon UI logon activity, a count of failed user logon activity, or a list of DNS queries by the specified user account.
NEW QUESTION # 48
While you're reviewing Unresolved Detections in the Host Search page, you notice the User Name column contains "hostnameS " What does this User Name indicate?
- A. The User Name is not relevant for the dashboard
- B. The User Name is a System User
- C. The Falcon sensor could not determine the User Name
- D. There is no User Name associated with the event
Answer: D
Explanation:
When you see "hostnameS" in the User Name column in the Host Search page, it means that there is no User Name associated with the event. This can happen when the event is related to a system process or service that does not have a user context. It does not mean that the User Name is a System User, that the User Name is not relevant for the dashboard, or that the Falcon sensor could not determine the User Name.
NEW QUESTION # 49
When performing a raw event search via the Events search page, what are Event Actions?
- A. Event Actions contains an audit information log of actions an analyst took in regards to a specific detection
- B. Event Actions contains the summary of actions taken by the Falcon sensor such as quarantining a file, prevent a process from executing or taking no actions and creating a detection only
- C. Event Actions are pivotable workflows including connecting to a host, pre-made event searches and pivots to other investigatory pages such as host search
- D. Event Actions is the field name that contains the event name defined in the Events Data Dictionary such as ProcessRollup, SyntheticProcessRollup, DNS request, etc
Answer: C
Explanation:
When performing a raw event search via the Events search page, Event Actions are pivotable workflows that allow you to perform various tasks related to the event or the host. For example, you can connect to a host using Real Time Response, run pre-made event searches based on the event type or name, or pivot to other investigatory pages such as host search, hash search, etc. Event Actions do not contain audit information log, summary of actions taken by the Falcon sensor, or the event name defined in the Events Data Dictionary.
NEW QUESTION # 50
Which threat framework allows a threat hunter to explore and model specific adversary tactics and techniques, with links to intelligence and case studies?
- A. NIST 800-171 Cyber Threat Framework
- B. Lockheed Martin Cyber Kill Chain
- C. MITRE ATT&CK
- D. Director of National Intelligence Cyber Threat Framework
Answer: C
Explanation:
MITRE ATT&CK is a threat framework that allows a threat hunter to explore and model specific adversary tactics and techniques, with links to intelligence and case studies. It is a knowledge base of adversary behaviors and tactics that covers various platforms, domains, and scenarios. It provides a common language and structure for threat hunters to understand and analyze threats, as well as to share findings and recommendations.
NEW QUESTION # 51
What information is provided when using IP Search to look up an IP address?
- A. Both internal and external IPs
- B. Suspicious IP addresses
- C. External IPs only
- D. Internal IPs only
Answer: C
Explanation:
IP Search is an Investigate tool that allows you to look up information about external IPs only. It shows information such as geolocation, network connection events, detection history, etc. for each external IP address that has communicated with your hosts. It does not show information about internal IPs, suspicious IPs, or both internal and external IPs.
NEW QUESTION # 52
Which of the following is a suspicious process behavior?
- A. PowerShell launching a PowerShell script
- B. An Internet browser (eg, Internet Explorer) performing multiple DNS requests
- C. PowerShell running an execution policy of RemoteSigned
- D. Non-network processes (eg, notepad exe) making an outbound network connection
Answer: D
Explanation:
Non-network processes are processes that are not expected to communicate over the network, such as notepad.exe. If they make an outbound network connection, it could indicate that they are compromised or maliciously used by an adversary. PowerShell running an execution policy of RemoteSigned is a default setting that allows local scripts to run without digital signatures. An Internet browser performing multiple DNS requests is a normal behavior for web browsing. PowerShell launching a PowerShell script is also a common behavior for legitimate tasks.
NEW QUESTION # 53
Event Search data is recorded with which time zone?
- A. PST
- B. UTC
- C. EST
- D. GMT
Answer: B
Explanation:
Event Search data is recorded with UTC (Coordinated Universal Time) time zone. UTC is a standard time zone that is used as a reference point for other time zones. PST (Pacific Standard Time), GMT (Greenwich Mean Time), and EST (Eastern Standard Time) are not the time zones that Event Search data is recorded with.
NEW QUESTION # 54
......
Latest Verified & Correct CCFH-202 Questions: https://www.examdumpsvce.com/CCFH-202-valid-exam-dumps.html
100% Pass Guaranteed Download CrowdStrike Certified Falcon Hunter Exam PDF Q&A: https://drive.google.com/open?id=1uOVU9DvSMK5FisnXmHxUXPtP5xCzVT4a
