Free demo
CCFH-202 Free Demo Questions
A sample from the full question set for this exam.
QUESTION 1 OF 5
Which of the following is a suspicious process behavior?
Correct Answer: D
Non - network processes are processes that are not expected to communicate over the network, such
as notepad.exe. If they make an outbound network connection, it could indicate that they are
compromised or maliciously used by an adversary. PowerShell running an execution policy of
RemoteSigned is a default setting that allows local scripts to run without digital signatures. An
Internet browser performing multiple DNS requests is a normal behavior for web browsing.
PowerShell launching a PowerShell script is also a common behavior for legitimate tasks.
Reference: https://www.crowdstrike.com/blog /tech - center/detect - malicious - use - of - non - network -
processes/
as notepad.exe. If they make an outbound network connection, it could indicate that they are
compromised or maliciously used by an adversary. PowerShell running an execution policy of
RemoteSigned is a default setting that allows local scripts to run without digital signatures. An
Internet browser performing multiple DNS requests is a normal behavior for web browsing.
PowerShell launching a PowerShell script is also a common behavior for legitimate tasks.
Reference: https://www.crowdstrike.com/blog /tech - center/detect - malicious - use - of - non - network -
processes/
QUESTION 2 OF 5
Which field should you reference in order to find the system time of a *FileWritten event?
Correct Answer: A
ContextTimeStamp_decimal is the field that shows the system time of the event that triggered the
sensor to send data to the cloud. In this case, it would be the time when the file was written.
FileTimeStamp_decimal is the field that shows the last modified time of the file, which may not be
the same as the time when the file was written. ProcessStartTime_decimal is the field that shows the
start time of the process that performed the file write operation, which may not be the same as the
time when the file was written. Timestamp is the field that shows the time when the sensor data was
received by the cloud, which may not be the same as the time when the file was written.
Reference: https://www.crowdstrike.com/blog /tech - center/understanding - timestamps - in -
crowdstrike - falcon/
sensor to send data to the cloud. In this case, it would be the time when the file was written.
FileTimeStamp_decimal is the field that shows the last modified time of the file, which may not be
the same as the time when the file was written. ProcessStartTime_decimal is the field that shows the
start time of the process that performed the file write operation, which may not be the same as the
time when the file was written. Timestamp is the field that shows the time when the sensor data was
received by the cloud, which may not be the same as the time when the file was written.
Reference: https://www.crowdstrike.com/blog /tech - center/understanding - timestamps - in -
crowdstrike - falcon/
QUESTION 3 OF 5
What Search page would help a threat hunter differentiate testing, DevOPs, or general user activity from adversary behavior?
Correct Answer: D
User Search is a search page that allows a threat hunter to search for user activity across endpoints
and correlate it with other events. This can help differentiate testing, DevOPs, or general user activity
from adversary behavior by identifying anomalous or suspicious user actions, such as logging into
multiple systems, running unusual commands, or accessing sensitive files.
Reference: https://www.crowdstrike.com/blog /tech - center/user - search - in - crowdstrike - falcon/
and correlate it with other events. This can help differentiate testing, DevOPs, or general user activity
from adversary behavior by identifying anomalous or suspicious user actions, such as logging into
multiple systems, running unusual commands, or accessing sensitive files.
Reference: https://www.crowdstrike.com/blog /tech - center/user - search - in - crowdstrike - falcon/
QUESTION 4 OF 5
An analyst has sorted all recent detections in the Falcon platform to identify the oldest in an effort to determine the possible first victim host What is this type of analysis called?
Correct Answer: C
Temporal analysis is a type of analysis that focuses on the timing and sequence of events in order to
identify patterns, trends, or anomalies. By sorting all recent detections in the Falcon platform to
identify the oldest, an analyst can perform temporal analysis to determine the possible first victim
host and trace back the origin of an attack.
Reference: https://www.crowdstrike.com/blog /tech - center/temporal - analysis - in - crowdstrike - falcon/
identify patterns, trends, or anomalies. By sorting all recent detections in the Falcon platform to
identify the oldest, an analyst can perform temporal analysis to determine the possible first victim
host and trace back the origin of an attack.
Reference: https://www.crowdstrike.com/blog /tech - center/temporal - analysis - in - crowdstrike - falcon/
QUESTION 5 OF 5
Refer to Exhibit.
Refer to Exhibit.
Falcon detected the above file attempting to execute. At initial glance; what indicators can we use to provide an initial analysis of the file?
Correct Answer: B
The file name, path, Local and Global prevalence are indicators that can provide an initial analysis of the file without relying on external sources or tools. The file name can indicate the purpose or origin of the file, such as if it is a legitimate application or a malicious payload. The file path can indicate where the file was located or executed from, such as if it was in a temporary or system directory. The Local and Global prevalence can indicate how common or rare the file is within the environment or across all Falcon customers, which can help assess the risk or impact of the file. Reference: https://www.crowdstrike.com/blog /tech - center/understanding - file - prevalence - in - crowdstrike - falcon/
Question 1 of 5