Changing the Concept of CCFH-202 Exam Preparation 2023 [Q28-Q52]

ExamBoosts December 17, 2023 CCFH-202 > CrowdStrike 0

Rate this post

Changing the Concept of CCFH-202 Exam Preparation 2023

Getting CCFH-202 Certification Made Easy! Get professional help from our CCFH-202 Dumps PDF

NEW QUESTION 28
You are reviewing a list of domains recently banned by your organization’s acceptable use policy. In particular, you are looking for the number of hosts that have visited each domain. Which tool should you use in Falcon?

Create a custom alert for each domain

Allowed Domain Summary Report

Bulk Domain Search

IP Addresses Search

Bulk Domain Search is the tool that you should use in Falcon to review a list of domains recently banned by your organization’s acceptable use policy and look for the number of hosts that have visited each domain. Bulk Domain Search is an Investigate tool that allows you to search for multiple domains at once and view their network connection events across all hosts in your environment. It shows information such as domain name, number of hosts visited, number of detections generated, etc. for each domain. Create a custom alert for each domain, Allowed Domain Summary Report, and IP Addresses Search are not tools that you should use for this purpose.

NEW QUESTION 29
Refer to Exhibit.

What type of attack would this process tree indicate?

Brute Forcing Attack

Man-in-the-middle Attack

Phishing Attack

Web Application Attack

This process tree indicates a phishing attack, as it shows a user opening an email attachment (outlook.exe) that launches a malicious macro (cmd.exe) that downloads and executes a payload (powershell.exe) that connects to a remote server (svchost.exe). A phishing attack is a type of social engineering attack that uses deceptive emails or messages to trick users into opening malicious attachments or links that can compromise their systems or credentials.

NEW QUESTION 30
Which document provides information on best practices for writing Splunk-based hunting queries, predefined queries which may be customized to hunt for suspicious network connections, and predefined queries which may be customized to hunt for suspicious processes?

Real Time Response and Network Containment

Hunting and Investigation

Events Data Dictionary

Incident and Detection Monitoring

The Hunting and Investigation document provides information on best practices for writing Splunk-based hunting queries, predefined queries which may be customized to hunt for suspicious network connections, and predefined queries which may be customized to hunt for suspicious processes. As explained above, the Hunting and Investigation document is a guide that provides sample hunting queries, select walkthroughs, and best practices for hunting with Falcon. The other documents do not provide the same information.

NEW QUESTION 31
Which tool allows a threat hunter to populate and colorize all known adversary techniques in a single view?

MISP

OWASP Threat Dragon

OpenXDR

MITRE ATT&CK Navigator

MITRE ATT&CK Navigator is a tool that allows a threat hunter to populate and colorize all known adversary techniques in a single view. It is based on the MITRE ATT&CK framework, which is a knowledge base of adversary behaviors and tactics. The tool enables threat hunters to create custom matrices, layers, annotations, and filters to explore and model specific adversary techniques, with links to intelligence and case studies.

NEW QUESTION 32
What Search page would help a threat hunter differentiate testing, DevOPs, or general user activity from adversary behavior?

Hash Search

IP Search

Domain Search

User Search

User Search is a search page that allows a threat hunter to search for user activity across endpoints and correlate it with other events. This can help differentiate testing, DevOPs, or general user activity from adversary behavior by identifying anomalous or suspicious user actions, such as logging into multiple systems, running unusual commands, or accessing sensitive files.

NEW QUESTION 33
In the MITRE ATT&CK Framework (version 11 – the newest version released in April 2022), which of the following pair of tactics is not in the Enterprise: Windows matrix?

Persistence and Execution

Impact and Collection

Privilege Escalation and Initial Access

Reconnaissance and Resource Development

Reconnaissance and Resource Development are two tactics that are not in the Enterprise: Windows matrix of the MITRE ATT&CK Framework (version 11). These two tactics are part of the PRE-ATT&CK matrix, which covers the actions that adversaries take before compromising a target. The Enterprise: Windows matrix covers the actions that adversaries take after gaining initial access to a Windows system. Persistence, Execution, Impact, Collection, Privilege Escalation, and Initial Access are all tactics that are in the Enterprise: Windows matrix.

NEW QUESTION 34
SPL (Splunk) eval statements can be used to convert Unix times (Epoch) into UTC readable time Which eval function is correct^

strftime

relative time

typeof

now

The strftime eval function is used to convert Unix times (Epoch) into UTC readable time. It takes two arguments: a Unix time field and a format string that specifies how to display the time. The now, typeof, and relative_time eval functions are not used to convert Unix times into UTC readable time.

NEW QUESTION 35
A benefit of using a threat hunting framework is that it:

Automatically generates incident reports

Eliminates false positives

Provides high fidelity threat actor attribution

Provides actionable, repeatable steps to conduct threat hunting

A threat hunting framework is a methodology that guides threat hunters in planning, executing, and improving their threat hunting activities. A benefit of using a threat hunting framework is that it provides actionable, repeatable steps to conduct threat hunting in a consistent and efficient manner. A threat hunting framework does not automatically generate incident reports, eliminate false positives, or provide high fidelity threat actor attribution, as these are dependent on other factors such as data sources, tools, and analysis skills.

NEW QUESTION 36
When exporting the results of the following event search, what data is saved in the exported file (assuming Verbose Mode)? event_simpleName=*Written | stats count by ComputerName

The text of the query

The results of the Statistics tab

No data Results can only be exported when the “table” command is used

All events in the Events tab

When exporting the results of an event search, the data that is saved in the exported file depends on the mode and the tab that is selected. In this case, the mode is Verbose and the tab is Statistics, as indicated by the stats command. Therefore, the data that is saved in the exported file is the results of the Statistics tab, which shows the count of events by ComputerName. The text of the query, all events in the Events tab, and no data are not correct answers.

NEW QUESTION 37
Which SPL (Splunk) field name can be used to automatically convert Unix times (Epoch) to UTC readable time within the Flacon Event Search?

utc_time

conv_time

_time

time

_time is the SPL (Splunk) field name that can be used to automatically convert Unix times (Epoch) to UTC readable time within the Falcon Event Search. It is a default field that shows the timestamp of each event in a human-readable format. utc_time, conv_time, and time are not valid SPL field names for converting Unix times to UTC readable time.

NEW QUESTION 38
Which of the following is a suspicious process behavior?

PowerShell running an execution policy of RemoteSigned

An Internet browser (eg, Internet Explorer) performing multiple DNS requests

PowerShell launching a PowerShell script

Non-network processes (eg, notepad exe) making an outbound network connection

Non-network processes are processes that are not expected to communicate over the network, such as notepad.exe. If they make an outbound network connection, it could indicate that they are compromised or maliciously used by an adversary. PowerShell running an execution policy of RemoteSigned is a default setting that allows local scripts to run without digital signatures. An Internet browser performing multiple DNS requests is a normal behavior for web browsing. PowerShell launching a PowerShell script is also a common behavior for legitimate tasks.

NEW QUESTION 39
You need details about key data fields and sensor events which you may expect to find from Hosts running the Falcon sensor. Which documentation should you access?

Events Data Dictionary

Streaming API Event Dictionary

Hunting and Investigation

Event stream APIs

The Events Data Dictionary found in the Falcon documentation is useful for writing hunting queries because it provides a reference of information about the events found in the Investigate > Event Search page of the Falcon Console. The Events Data Dictionary describes each event type, field name, data type, description, and example value that can be used to query and analyze event data. The Streaming API Event Dictionary, Hunting and Investigation, and Event stream APIs are not documentation that provide details about key data fields and sensor events.

NEW QUESTION 40
Which of the following is TRUE about a Hash Search?

Wildcard searches are not permitted with the Hash Search

The Hash Search provides Process Execution History

The Hash Search is available on Linux

Module Load History is not presented in a Hash Search

The Hash Search is an Investigate tool that allows you to search for a file hash and view its process execution history across all hosts in your environment. It shows information such as process name, command line, parent process name, parent command line, etc. for each execution of the file hash. Wildcard searches are permitted with the Hash Search, as long as they are at least four characters long. The Hash Search is available on Linux, as well as Windows and Mac OS X. Module Load History is presented in a Hash Search, along with other information such as File Write History and Detection History.

NEW QUESTION 41
To find events that are outliers inside a network,___________is the best hunting method to use.

time-based

machine learning

searching

stacking

Stacking (Frequency Analysis) is the best hunting method to use to find events that are outliers inside a network. Stacking involves grouping events by a common attribute and counting their frequency, then sorting them by ascending or descending order to identify rare or common events. This can help find anomalies or deviations from normal behavior that could indicate malicious activity. Time-based searching, machine learning, and searching are not specific hunting methods to find outliers.

NEW QUESTION 42
In the Powershell Hunt report, what does the “score” signify?

Number of hosts that ran the PowerShell script

How recently the PowerShell script executed

Maliciousness score determined by NGAV

A cumulative score of the various potential command line switches

In the Powershell Hunt report, the score signifies a cumulative score of the various potential command line switches that were used in the PowerShell script execution. The score is based on a weighted system that assigns different values to different switches based on their potential maliciousness or usefulness for threat hunting. For example, -EncodedCommand has a higher value than -NoProfile. The score does not signify the number of hosts that ran the PowerShell script, how recently the PowerShell script executed, or the maliciousness score determined by NGAV.

NEW QUESTION 43
How do you rename fields while using transforming commands such as table, chart, and stats?

By renaming the fields with the “rename” command after the transforming command e.g. “stats count by ComputerName | rename count AS total_count”

You cannot rename fields as it would affect sub-queries and statistical analysis

By using the “renamed” keyword after the field name eg “stats count renamed totalcount by ComputerName”

By specifying the desired name after the field name eg “stats count totalcount by ComputerName”

The rename command is used to rename fields while using transforming commands such as table, chart, and stats. It can be used after the transforming command and specify the old and new field names with the AS keyword. You can rename fields as it would not affect sub-queries and statistical analysis, as long as you use the correct field names in your queries. The renamed keyword and the desired name after the field name are not valid ways to rename fields.

NEW QUESTION 44
Which of the following is an example of actor actions during the RECONNAISSANCE phase of the Cyber Kill Chain?

Installing a backdoor on the victim endpoint

Discovering internet-facing servers

Emailing the intended victim with a malware attachment

Loading a malicious payload into a common DLL

Discovering internet-facing servers is an example of actor actions during the RECONNAISSANCE phase of the Cyber Kill Chain. The RECONNAISSANCE phase is where the adversary researches and identifies targets, vulnerabilities, and attack vectors. Discovering internet-facing servers is a way for the adversary to find potential entry points or weaknesses in the target network.

NEW QUESTION 45
An analyst has sorted all recent detections in the Falcon platform to identify the oldest in an effort to determine the possible first victim host What is this type of analysis called?

Visualization of hosts

Statistical analysis

Temporal analysis

Machine Learning

Temporal analysis is a type of analysis that focuses on the timing and sequence of events in order to identify patterns, trends, or anomalies. By sorting all recent detections in the Falcon platform to identify the oldest, an analyst can perform temporal analysis to determine the possible first victim host and trace back the origin of an attack.

NEW QUESTION 46
Lateral movement through a victim environment is an example of which stage of the Cyber Kill Chain?

Command & Control

Actions on Objectives

Exploitation

Delivery

Lateral movement through a victim environment is an example of the Command & Control stage of the Cyber Kill Chain. The Cyber Kill Chain is a model that describes the phases of a cyber attack, from reconnaissance to actions on objectives. The Command & Control stage is where the adversary establishes and maintains communication with the compromised systems and moves laterally to expand their access and control.

NEW QUESTION 47
What information is provided when using IP Search to look up an IP address?

Both internal and external IPs

Suspicious IP addresses

External IPs only

Internal IPs only

IP Search is an Investigate tool that allows you to look up information about external IPs only. It shows information such as geolocation, network connection events, detection history, etc. for each external IP address that has communicated with your hosts. It does not show information about internal IPs, suspicious IPs, or both internal and external IPs.

NEW QUESTION 48
What information is shown in Host Search?

Quarantined Files

Prevention Policies

Intel Reports

Processes and Services

Processes and Services is one of the information that is shown in Host Search. Host Search is an Investigate tool that allows you to view events by category, such as process executions, network connections, file writes, etc. Processes and Services is one of the categories that shows information such as process name, command line, parent process name, parent command line, etc. for each process execution event on a host. Quarantined Files, Prevention Policies, and Intel Reports are not shown in Host Search.

NEW QUESTION 49
You want to produce a list of all event occurrences along with selected fields such as the full path, time, username etc. Which command would be the appropriate choice?

fields

distinct count

table

values

The table command is used to produce a list of all event occurrences along with selected fields such as the full path, time, username etc. It takes one or more field names as arguments and displays them in a tabular format. The fields command is used to keep or remove fields from search results, not to display them in a list. The distinct_count command is used to count the number of distinct values of a field, not to display them in a list. The values command is used to display a list of unique values of a field within each group, not to display all event occurrences.

NEW QUESTION 50
Which field should you reference in order to find the system time of a *FileWritten event?

ContextTimeStamp_decimal

FileTimeStamp_decimal

ProcessStartTime_decimal

timestamp

ContextTimeStamp_decimal is the field that shows the system time of the event that triggered the sensor to send data to the cloud. In this case, it would be the time when the file was written. FileTimeStamp_decimal is the field that shows the last modified time of the file, which may not be the same as the time when the file was written. ProcessStartTime_decimal is the field that shows the start time of the process that performed the file write operation, which may not be the same as the time when the file was written. Timestamp is the field that shows the time when the sensor data was received by the cloud, which may not be the same as the time when the file was written.

NEW QUESTION 51
In which of the following stages of the Cyber Kill Chain does the actor not interact with the victim endpoint(s)?

Exploitation

Weaponization

Command & control

Installation

Weaponization is the stage of the Cyber Kill Chain where the actor does not interact with the victim endpoint(s). Weaponization is where the actor prepares or packages the exploit or payload that will be used to compromise the target. This stage does not involve any communication or interaction with the victim endpoint(s), as it is done by the actor before delivering the weaponized content. Exploitation, Command & Control, and Installation are all stages where the actor interacts with the victim endpoint(s), either by executing code, establishing communication, or installing malware.

NEW QUESTION 52
The Falcon Detections page will attempt to decode Encoded PowerShell Command line parameters when which PowerShell Command line parameter is present?

-Command

-Hidden

-e

-nop

The Falcon Detections page will attempt to decode Encoded PowerShell Command line parameters when the -Command parameter is present. The -Command parameter allows PowerShell to execute a specified script block or string. If the script block or string is encoded using Base64 or other methods, the Falcon Detections page will try to decode it and show the original command. The -Hidden, -e, and -nop parameters are not related to encoding or decoding PowerShell commands.

Loading …

CrowdStrike CCFH-202 Exam Syllabus Topics:

Topic	Details
Topic 1	Utilize the MITRE ATT&CK Framework to model threat actor behaviors Explain what information a bulk (Destination) IP search provides
Topic 2	Explain what information a Mac Sensor Report will provide Conduct hypothesis and hunting lead generation to prove them out using Falcon tools
Topic 3	Locate built-in Hunting reports and explain what they provide Identify alternative analytical interpretations to minimize and reduce false positives
Topic 4	Explain what information a Source IP Search provides Explain what the “table” command does and demonstrate how it can be used for formatting output
Topic 5	Convert and format Unix times to UTC-readable time Evaluate information for reliability, validity and relevance for use in the process of elimination
Topic 6	Explain what information is in the Hunting & Investigation Guide Differentiate testing, DevOps or general user activity from adversary behavior