CrowdStrike CCFH-202 Quiz 1 Topic 2 Questions 1-5

Question: 1

Which pre-defined reports offer information surrounding activities that typically indicate suspicious activity occurring on a system?

AScheduled searches

BHunt reports

CSensor reports

DTimeline reports

Show Answer

Question: 2

You want to produce a list of all event occurrences along with selected fields such as the full path, time, username etc. Which command would be the appropriate choice?

Afields

Bdistinct count

Ctable

Dvalues

Show Answer

Question: 3

What Search page would help a threat hunter differentiate testing, DevOPs, or general user activity from adversary behavior?

AHash Search

BIP Search

CDomain Search

DUser Search

Show Answer

Question: 4

Which of the following is an example of a Falcon threat hunting lead?

AA routine threat hunt query showing process executions of single letter filename (e.g., a.exe) from temporary directories

BSecurity appliance logs showing potentially bad traffic to an unknown external IP address

CA help desk ticket for a user clicking on a link in an email causing their machine to become unresponsive and have high CPU usage

DAn external report describing a unique 5 character file extension for ransomware encrypted files

Show Answer

Question: 5

Which document provides information on best practices for writing Splunk-based hunting queries, predefined queries which may be customized to hunt for suspicious network connections, and predefined queries which may be customized to hunt for suspicious processes?

AReal Time Response and Network Containment

BHunting and Investigation

CEvents Data Dictionary

DIncident and Detection Monitoring

Show Answer

CrowdStrike CCFH-202 Quiz:1 Topic:2 Questions:1-5