2023 The Most Effective CCFH-202 with 62 Questions Answers
Try Free and Start Using Realistic Verified CCFH-202 Dumps Instantly.
NEW QUESTION # 34
What is the difference between a Host Search and a Host Timeline?
- A. You access a Host Search from a detection to show you every recorded process event related to the detection and you can only populate the Host Timeline fields manually
- B. Host Search is used for detection investigation and Host Timeline is used for proactive hunting
- C. A Host Search organizes the data in useful event categories like process executions and network connections, a Host Timeline provides an uncategorized view of recorded events in chronological order
- D. There is no difference. You just get to them different ways
Answer: C
Explanation:
This is the difference between a Host Search and a Host Timeline. A Host Search is an Investigate tool that allows you to view events by category, such as process executions, network connections, file writes, etc. A Host Timeline is an Investigate tool that allows you to view all events in chronological order, without any categorization. Both tools can be used for detection investigation and proactive hunting, depending on the use case and preference. You can access a Host Search from a detection or manually enter the host details. You can also populate the Host Timeline fields manually or from other pages in Falcon.
NEW QUESTION # 35
Which Falcon documentation guide should you reference to hunt for anomalies related to scheduled tasks and other Windows related artifacts?
- A. MITRE-Based Falcon Detections Framework
- B. Hunting and Investigation
- C. Events Data Dictionary
- D. Customizable Dashboards
Answer: B
Explanation:
The Hunting and Investigation guide is the Falcon documentation guide that you should reference to hunt for anomalies related to scheduled tasks and other Windows related artifacts. The Hunting and Investigation guide provides sample hunting queries, select walkthroughs, and best practices for hunting with Falcon. It covers various topics such as process execution, network connections, registry activity, scheduled tasks, and more.
NEW QUESTION # 36
The Falcon Detections page will attempt to decode Encoded PowerShell Command line parameters when which PowerShell Command line parameter is present?
- A. -e
- B. -Hidden
- C. -Command
- D. -nop
Answer: C
Explanation:
The Falcon Detections page will attempt to decode Encoded PowerShell Command line parameters when the -Command parameter is present. The -Command parameter allows PowerShell to execute a specified script block or string. If the script block or string is encoded using Base64 or other methods, the Falcon Detections page will try to decode it and show the original command. The -Hidden, -e, and -nop parameters are not related to encoding or decoding PowerShell commands.
NEW QUESTION # 37
While you're reviewing Unresolved Detections in the Host Search page, you notice the User Name column contains "hostnameS " What does this User Name indicate?
- A. The User Name is not relevant for the dashboard
- B. There is no User Name associated with the event
- C. The Falcon sensor could not determine the User Name
- D. The User Name is a System User
Answer: B
Explanation:
When you see "hostnameS" in the User Name column in the Host Search page, it means that there is no User Name associated with the event. This can happen when the event is related to a system process or service that does not have a user context. It does not mean that the User Name is a System User, that the User Name is not relevant for the dashboard, or that the Falcon sensor could not determine the User Name.
NEW QUESTION # 38
What topics are presented in the Hunting and Investigation Guide?
- A. Detailed tutorial on writing advanced queries such as sub-searches and joins
- B. Recommended platform configurations and prevention settings to ensure detections are generated for hunting leads
- C. Detailed summary of event names, descriptions, and some key data fields for hunting and investigation
- D. Sample hunting queries, select walkthroughs and best practices for hunting with Falcon
Answer: D
Explanation:
This is the correct answer for the same reason as above. The Hunting and Investigation guide provides sample hunting queries, select walkthroughs, and best practices for hunting with Falcon. It does not provide a detailed tutorial on writing advanced queries, a detailed summary of event names and descriptions, or recommended platform configurations and prevention settings.
NEW QUESTION # 39
Which field in a DNS Request event points to the responsible process?
- A. ParentProcessId_decimal
- B. ContextProcessld_decimal
- C. TargetProcessld_decimal
- D. ContextProcessld_readable
Answer: D
Explanation:
The ContextProcessld_readable field in a DNS Request event points to the responsible process. The ContextProcessld_readable field is the readable representation of the process identifier for the process that initiated the DNS request. It can be used to identify which process was communicating with a specific domain or IP address. The TargetProcessld_decimal, ContextProcessld_decimal, and ParentProcessId_decimal fields do not point to the responsible process.
NEW QUESTION # 40
Which of the following does the Hunting and Investigation Guide contain?
- A. Example Event Search queries useful for threat hunting
- B. A list of all event types specifically used for hunting and their syntax
- C. A list of all event types and their syntax
- D. Example Event Search queries useful for Falcon platform configuration
Answer: A
Explanation:
The Hunting and Investigation guide contains example Event Search queries useful for threat hunting. These queries are based on common threat hunting use cases and scenarios, such as finding suspicious processes, network connections, registry activity, etc. The guide also explains how to customize and modify the queries to suit different needs and environments. The guide does not contain a list of all event types and their syntax, as that information is provided in the Events Data Dictionary. The guide also does not contain example Event Search queries useful for Falcon platform configuration, as that is not the focus of the guide.
NEW QUESTION # 41
What do you click to jump to a Process Timeline from many pages in Falcon, such as a Hash Search?
- A. CID
- B. Process ID or Parent Process ID
- C. PID
- D. Process Timeline Link
Answer: D
Explanation:
The Process Timeline Link is what you click to jump to a Process Timeline from many pages in Falcon, such as a Hash Search. The Process Timeline Link is an icon that looks like three horizontal bars with dots on them. It appears next to each process name or ID on various pages in Falcon, such as Hash Search results, Detection details, Event Search results, etc. Clicking on it will open a new tab with the Process Timeline for that process. The PID, the Process ID or Parent Process ID, and the CID are not what you click to jump to a Process Timeline.
NEW QUESTION # 42
When performing a raw event search via the Events search page, what are Event Actions?
- A. Event Actions is the field name that contains the event name defined in the Events Data Dictionary such as ProcessRollup, SyntheticProcessRollup, DNS request, etc
- B. Event Actions contains the summary of actions taken by the Falcon sensor such as quarantining a file, prevent a process from executing or taking no actions and creating a detection only
- C. Event Actions are pivotable workflows including connecting to a host, pre-made event searches and pivots to other investigatory pages such as host search
- D. Event Actions contains an audit information log of actions an analyst took in regards to a specific detection
Answer: C
Explanation:
When performing a raw event search via the Events search page, Event Actions are pivotable workflows that allow you to perform various tasks related to the event or the host. For example, you can connect to a host using Real Time Response, run pre-made event searches based on the event type or name, or pivot to other investigatory pages such as host search, hash search, etc. Event Actions do not contain audit information log, summary of actions taken by the Falcon sensor, or the event name defined in the Events Data Dictionary.
NEW QUESTION # 43
In the Powershell Hunt report, what does the "score" signify?
- A. Maliciousness score determined by NGAV
- B. How recently the PowerShell script executed
- C. A cumulative score of the various potential command line switches
- D. Number of hosts that ran the PowerShell script
Answer: C
Explanation:
In the Powershell Hunt report, the score signifies a cumulative score of the various potential command line switches that were used in the PowerShell script execution. The score is based on a weighted system that assigns different values to different switches based on their potential maliciousness or usefulness for threat hunting. For example, -EncodedCommand has a higher value than -NoProfile. The score does not signify the number of hosts that ran the PowerShell script, how recently the PowerShell script executed, or the maliciousness score determined by NGAV.
NEW QUESTION # 44
The Events Data Dictionary found in the Falcon documentation is useful for writing hunting queries because:
- A. It provides a reference of information about the events found in the Investigate > Event Search page of the Falcon Console
- B. It provides pre-defined queries you can customize to meet your specific threat hunting needs
- C. It provides a list of compatible splunk commands used to query event data
- D. It provides a list of all the detect names and descriptions found in the Falcon Cloud
Answer: A
Explanation:
This is the correct answer for the same reason as above. The Events Data Dictionary provides a reference of information about the events found in the Investigate > Event Search page of the Falcon Console, which is useful for writing hunting queries. It does not provide pre-defined queries, detect names and descriptions, or compatible splunk commands.
NEW QUESTION # 45
In the Powershell Hunt report, what does the filtering condition of commandLine! ="*badstring* " do?
- A. Displays only the command lines containing "badstring"
- B. Highlights only the command lines containing "badstring"
- C. Prevents command lines containing "badstring" from being displayed
- D. Highlights "badstring" in all command lines in the output
Answer: C
Explanation:
In the Powershell Hunt report, the filtering condition of commandLine! ="badstring " prevents command lines containing "badstring" from being displayed. The ! operator is used to negate or exclude a condition from the search results. The * operator is used as a wildcard to match any number of characters before or after the specified string. Therefore, commandLine! ="badstring " means to filter out any command line that has "badstring" anywhere in it. The other options are not correct, as they do not describe what the filtering condition does.
NEW QUESTION # 46
Refer to Exhibit.
Falcon detected the above file attempting to execute. At initial glance; what indicators can we use to provide an initial analysis of the file?
- A. Local prevalence, IOC Management action, and Event Search
- B. VirusTotal, Hybrid Analysis, and Google pivot indicator lights enabled
- C. File name, path, Local and Global prevalence within the environment
- D. File path, hard disk volume number, and IOC Management action
Answer: C
Explanation:
The file name, path, Local and Global prevalence are indicators that can provide an initial analysis of the file without relying on external sources or tools. The file name can indicate the purpose or origin of the file, such as if it is a legitimate application or a malicious payload. The file path can indicate where the file was located or executed from, such as if it was in a temporary or system directory. The Local and Global prevalence can indicate how common or rare the file is within the environment or across all Falcon customers, which can help assess the risk or impact of the file.
NEW QUESTION # 47
What Search page would help a threat hunter differentiate testing, DevOPs, or general user activity from adversary behavior?
- A. IP Search
- B. Domain Search
- C. Hash Search
- D. User Search
Answer: D
Explanation:
User Search is a search page that allows a threat hunter to search for user activity across endpoints and correlate it with other events. This can help differentiate testing, DevOPs, or general user activity from adversary behavior by identifying anomalous or suspicious user actions, such as logging into multiple systems, running unusual commands, or accessing sensitive files.
NEW QUESTION # 48
Lateral movement through a victim environment is an example of which stage of the Cyber Kill Chain?
- A. Actions on Objectives
- B. Delivery
- C. Command & Control
- D. Exploitation
Answer: C
Explanation:
Lateral movement through a victim environment is an example of the Command & Control stage of the Cyber Kill Chain. The Cyber Kill Chain is a model that describes the phases of a cyber attack, from reconnaissance to actions on objectives. The Command & Control stage is where the adversary establishes and maintains communication with the compromised systems and moves laterally to expand their access and control.
NEW QUESTION # 49
A benefit of using a threat hunting framework is that it:
- A. Provides actionable, repeatable steps to conduct threat hunting
- B. Automatically generates incident reports
- C. Provides high fidelity threat actor attribution
- D. Eliminates false positives
Answer: A
Explanation:
A threat hunting framework is a methodology that guides threat hunters in planning, executing, and improving their threat hunting activities. A benefit of using a threat hunting framework is that it provides actionable, repeatable steps to conduct threat hunting in a consistent and efficient manner. A threat hunting framework does not automatically generate incident reports, eliminate false positives, or provide high fidelity threat actor attribution, as these are dependent on other factors such as data sources, tools, and analysis skills.
NEW QUESTION # 50
Which tool allows a threat hunter to populate and colorize all known adversary techniques in a single view?
- A. MITRE ATT&CK Navigator
- B. OWASP Threat Dragon
- C. MISP
- D. OpenXDR
Answer: A
Explanation:
MITRE ATT&CK Navigator is a tool that allows a threat hunter to populate and colorize all known adversary techniques in a single view. It is based on the MITRE ATT&CK framework, which is a knowledge base of adversary behaviors and tactics. The tool enables threat hunters to create custom matrices, layers, annotations, and filters to explore and model specific adversary techniques, with links to intelligence and case studies.
NEW QUESTION # 51
In the MITRE ATT&CK Framework (version 11 - the newest version released in April 2022), which of the following pair of tactics is not in the Enterprise: Windows matrix?
- A. Impact and Collection
- B. Persistence and Execution
- C. Privilege Escalation and Initial Access
- D. Reconnaissance and Resource Development
Answer: D
Explanation:
Reconnaissance and Resource Development are two tactics that are not in the Enterprise: Windows matrix of the MITRE ATT&CK Framework (version 11). These two tactics are part of the PRE-ATT&CK matrix, which covers the actions that adversaries take before compromising a target. The Enterprise: Windows matrix covers the actions that adversaries take after gaining initial access to a Windows system. Persistence, Execution, Impact, Collection, Privilege Escalation, and Initial Access are all tactics that are in the Enterprise: Windows matrix.
NEW QUESTION # 52
......
Download Free Latest Exam CCFH-202 Certified Sample Questions: https://testking.itexamdownload.com/CCFH-202-valid-questions.html