[Jul-2026] The Best CrowdStrike Falcon Certification Program CCFH-202b Professional Exam Questions
Try 100% Updated CCFH-202b Exam Questions [2026]
NEW QUESTION # 17
SPL (Splunk) eval statements can be used to convert Unix times (Epoch) into UTC readable time Which eval function is correct^
- A. typeof
- B. now
- C. strftime
- D. relative time
Answer: C
Explanation:
The strftime eval function is used to convert Unix times (Epoch) into UTC readable time. It takes two arguments: a Unix time field and a format string that specifies how to display the time. The now, typeof, and relative_time eval functions are not used to convert Unix times into UTC readable time.
NEW QUESTION # 18
Where would an analyst find information about shells spawned by root, Kernel Module loads, and wget/curl usage?
- A. Sensor Health report
- B. Mac Sensor report
- C. Sensor Policy Daily report
- D. Linux Sensor report
Answer: D
Explanation:
The Linux Sensor report is where an analyst would find information about shells spawned by root, Kernel Module loads, and wget/curl usage. The Linux Sensor report is a pre-defined report that provides a summary view of selected activities on Linux hosts. It shows information such as process execution events, network connection events, file write events, etc. that occurred on Linux hosts within a specified time range. The Sensor Health report, the Sensor Policy Daily report, and the Mac Sensor report do not provide the same information.
NEW QUESTION # 19
What Search page would help a threat hunter differentiate testing, DevOPs, or general user activity from adversary behavior?
- A. User Search
- B. IP Search
- C. Domain Search
- D. Hash Search
Answer: A
Explanation:
User Search is a search page that allows a threat hunter to search for user activity across endpoints and correlate it with other events. This can help differentiate testing, DevOPs, or general user activity from adversary behavior by identifying anomalous or suspicious user actions, such as logging into multiple systems, running unusual commands, or accessing sensitive files.
NEW QUESTION # 20
A benefit of using a threat hunting framework is that it:
- A. Provides high fidelity threat actor attribution
- B. Provides actionable, repeatable steps to conduct threat hunting
- C. Automatically generates incident reports
- D. Eliminates false positives
Answer: B
Explanation:
A threat hunting framework is a methodology that guides threat hunters in planning, executing, and improving their threat hunting activities. A benefit of using a threat hunting framework is that it provides actionable, repeatable steps to conduct threat hunting in a consistent and efficient manner. A threat hunting framework does not automatically generate incident reports, eliminate false positives, or provide high fidelity threat actor attribution, as these are dependent on other factors such as data sources, tools, and analysis skills.
NEW QUESTION # 21
You are reviewing a list of domains recently banned by your organization's acceptable use policy. In particular, you are looking for the number of hosts that have visited each domain. Which tool should you use in Falcon?
- A. Create a custom alert for each domain
- B. IP Addresses Search
- C. Bulk Domain Search
- D. Allowed Domain Summary Report
Answer: C
Explanation:
Bulk Domain Search is the tool that you should use in Falcon to review a list of domains recently banned by your organization's acceptable use policy and look for the number of hosts that have visited each domain. Bulk Domain Search is an Investigate tool that allows you to search for multiple domains at once and view their network connection events across all hosts in your environment. It shows information such as domain name, number of hosts visited, number of detections generated, etc. for each domain. Create a custom alert for each domain, Allowed Domain Summary Report, and IP Addresses Search are not tools that you should use for this purpose.
NEW QUESTION # 22
In which of the following stages of the Cyber Kill Chain does the actor not interact with the victim endpoint(s)?
- A. Installation
- B. Command & control
- C. Exploitation
- D. Weaponization
Answer: D
Explanation:
Weaponization is the stage of the Cyber Kill Chain where the actor does not interact with the victim endpoint(s). Weaponization is where the actor prepares or packages the exploit or payload that will be used to compromise the target. This stage does not involve any communication or interaction with the victim endpoint(s), as it is done by the actor before delivering the weaponized content. Exploitation, Command & Control, and Installation are all stages where the actor interacts with the victim endpoint(s), either by executing code, establishing communication, or installing malware.
NEW QUESTION # 23
What information is provided from the MITRE ATT&CK framework in a detection's Execution Details?
- A. Technique ID
- B. Command Line
- C. Grouping Tag
- D. Triggering Indicator
Answer: A
Explanation:
Technique ID is the information that is provided from the MITRE ATT&CK framework in a detection's Execution Details. Technique ID is a unique identifier for each technique in the MITRE ATT&CK framework, such as T1059 for Command and Scripting Interpreter or T1566 for Phishing. Technique ID helps to map a detection to a specific adversary behavior and tactic. Grouping Tag, Command Line, and Triggering Indicator are not information that is provided from the MITRE ATT&CK framework in a detection's Execution Details.
NEW QUESTION # 24
What is the difference between a Host Search and a Host Timeline?
- A. You access a Host Search from a detection to show you every recorded process event related to the detection and you can only populate the Host Timeline fields manually
- B. Host Search is used for detection investigation and Host Timeline is used for proactive hunting
- C. A Host Search organizes the data in useful event categories like process executions and network connections, a Host Timeline provides an uncategorized view of recorded events in chronological order
- D. There is no difference. You just get to them different ways
Answer: C
Explanation:
This is the difference between a Host Search and a Host Timeline. A Host Search is an Investigate tool that allows you to view events by category, such as process executions, network connections, file writes, etc. A Host Timeline is an Investigate tool that allows you to view all events in chronological order, without any categorization. Both tools can be used for detection investigation and proactive hunting, depending on the use case and preference. You can access a Host Search from a detection or manually enter the host details. You can also populate the Host Timeline fields manually or from other pages in Falcon.
NEW QUESTION # 25
What kind of activity does a User Search help you investigate?
- A. A list of DNS queries by the specified user account
- B. A history of Falcon Ul logon activity
- C. A list of process activity executed by the specified user account
- D. A count of failed user logon activity
Answer: C
Explanation:
User Search is an Investigate tool that helps you investigate a list of process activity executed by the specified user account. It shows information such as process name, command line, parent process name, parent command line, etc. for each process that was executed by the user account on any host in your environment. It does not show a history of Falcon UI logon activity, a count of failed user logon activity, or a list of DNS queries by the specified user account.
NEW QUESTION # 26
What is the main purpose of the Mac Sensor report?
- A. To provide a summary view of selected activities on Mac hosts
- B. To provide a dashboard for Mac related detections
- C. To identify endpoints that are in Reduced Functionality Mode
- D. To provide vulnerability assessment for Mac Operating Systems
Answer: A
Explanation:
The Mac Sensor report is a pre-defined report that provides a summary view of selected activities on Mac hosts. It shows information such as process execution events, network connection events, file write events, etc. that occurred on Mac hosts within a specified time range. The Mac Sensor report does not identify endpoints that are in Reduced Functionality Mode, provide vulnerability assessment for Mac Operating Systems, or provide a dashboard for Mac related detections.
NEW QUESTION # 27
Refer to Exhibit.
What type of attack would this process tree indicate?
- A. Web Application Attack
- B. Phishing Attack
- C. Man-in-the-middle Attack
- D. Brute Forcing Attack
Answer: B
Explanation:
This process tree indicates a phishing attack, as it shows a user opening an email attachment (outlook.exe) that launches a malicious macro (cmd.exe) that downloads and executes a payload (powershell.exe) that connects to a remote server (svchost.exe). A phishing attack is a type of social engineering attack that uses deceptive emails or messages to trick users into opening malicious attachments or links that can compromise their systems or credentials.
NEW QUESTION # 28
The Events Data Dictionary found in the Falcon documentation is useful for writing hunting queries because:
- A. It provides a list of all the detect names and descriptions found in the Falcon Cloud
- B. It provides a reference of information about the events found in the Investigate > Event Search page of the Falcon Console
- C. It provides a list of compatible splunk commands used to query event data
- D. It provides pre-defined queries you can customize to meet your specific threat hunting needs
Answer: B
Explanation:
This is the correct answer for the same reason as above. The Events Data Dictionary provides a reference of information about the events found in the Investigate > Event Search page of the Falcon Console, which is useful for writing hunting queries. It does not provide pre-defined queries, detect names and descriptions, or compatible splunk commands.
NEW QUESTION # 29
Which field in a DNS Request event points to the responsible process?
- A. ParentProcessId_decimal
- B. ContextProcessld_readable
- C. ContextProcessld_decimal
- D. TargetProcessld_decimal
Answer: B
Explanation:
The ContextProcessld_readable field in a DNS Request event points to the responsible process. The ContextProcessld_readable field is the readable representation of the process identifier for the process that initiated the DNS request. It can be used to identify which process was communicating with a specific domain or IP address. The TargetProcessld_decimal, ContextProcessld_decimal, and ParentProcessId_decimal fields do not point to the responsible process.
NEW QUESTION # 30
Which of the following is a suspicious process behavior?
- A. PowerShell running an execution policy of RemoteSigned
- B. An Internet browser (eg, Internet Explorer) performing multiple DNS requests
- C. PowerShell launching a PowerShell script
- D. Non-network processes (eg, notepad exe) making an outbound network connection
Answer: D
Explanation:
Non-network processes are processes that are not expected to communicate over the network, such as notepad.exe. If they make an outbound network connection, it could indicate that they are compromised or maliciously used by an adversary. PowerShell running an execution policy of RemoteSigned is a default setting that allows local scripts to run without digital signatures. An Internet browser performing multiple DNS requests is a normal behavior for web browsing. PowerShell launching a PowerShell script is also a common behavior for legitimate tasks.
NEW QUESTION # 31
Which document provides information on best practices for writing Splunk-based hunting queries, predefined queries which may be customized to hunt for suspicious network connections, and predefined queries which may be customized to hunt for suspicious processes?
- A. Real Time Response and Network Containment
- B. Hunting and Investigation
- C. Events Data Dictionary
- D. Incident and Detection Monitoring
Answer: B
Explanation:
The Hunting and Investigation document provides information on best practices for writing Splunk-based hunting queries, predefined queries which may be customized to hunt for suspicious network connections, and predefined queries which may be customized to hunt for suspicious processes. As explained above, the Hunting and Investigation document is a guide that provides sample hunting queries, select walkthroughs, and best practices for hunting with Falcon. The other documents do not provide the same information.
NEW QUESTION # 32
When performing a raw event search via the Events search page, what are Event Actions?
- A. Event Actions contains an audit information log of actions an analyst took in regards to a specific detection
- B. Event Actions contains the summary of actions taken by the Falcon sensor such as quarantining a file, prevent a process from executing or taking no actions and creating a detection only
- C. Event Actions are pivotable workflows including connecting to a host, pre-made event searches and pivots to other investigatory pages such as host search
- D. Event Actions is the field name that contains the event name defined in the Events Data Dictionary such as ProcessRollup, SyntheticProcessRollup, DNS request, etc
Answer: C
Explanation:
When performing a raw event search via the Events search page, Event Actions are pivotable workflows that allow you to perform various tasks related to the event or the host. For example, you can connect to a host using Real Time Response, run pre-made event searches based on the event type or name, or pivot to other investigatory pages such as host search, hash search, etc. Event Actions do not contain audit information log, summary of actions taken by the Falcon sensor, or the event name defined in the Events Data Dictionary.
NEW QUESTION # 33
Which of the following is TRUE about a Hash Search?
- A. Module Load History is not presented in a Hash Search
- B. The Hash Search provides Process Execution History
- C. Wildcard searches are not permitted with the Hash Search
- D. The Hash Search is available on Linux
Answer: B
Explanation:
The Hash Search is an Investigate tool that allows you to search for a file hash and view its process execution history across all hosts in your environment. It shows information such as process name, command line, parent process name, parent command line, etc. for each execution of the file hash. Wildcard searches are permitted with the Hash Search, as long as they are at least four characters long. The Hash Search is available on Linux, as well as Windows and Mac OS X. Module Load History is presented in a Hash Search, along with other information such as File Write History and Detection History.
NEW QUESTION # 34
An analyst has sorted all recent detections in the Falcon platform to identify the oldest in an effort to determine the possible first victim host What is this type of analysis called?
- A. Machine Learning
- B. Temporal analysis
- C. Visualization of hosts
- D. Statistical analysis
Answer: B
Explanation:
Temporal analysis is a type of analysis that focuses on the timing and sequence of events in order to identify patterns, trends, or anomalies. By sorting all recent detections in the Falcon platform to identify the oldest, an analyst can perform temporal analysis to determine the possible first victim host and trace back the origin of an attack.
NEW QUESTION # 35
What do you click to jump to a Process Timeline from many pages in Falcon, such as a Hash Search?
- A. Process Timeline Link
- B. PID
- C. Process ID or Parent Process ID
- D. CID
Answer: A
Explanation:
The Process Timeline Link is what you click to jump to a Process Timeline from many pages in Falcon, such as a Hash Search. The Process Timeline Link is an icon that looks like three horizontal bars with dots on them. It appears next to each process name or ID on various pages in Falcon, such as Hash Search results, Detection details, Event Search results, etc. Clicking on it will open a new tab with the Process Timeline for that process. The PID, the Process ID or Parent Process ID, and the CID are not what you click to jump to a Process Timeline.
NEW QUESTION # 36
Adversaries commonly execute discovery commands such as netexe, ipconfig.exe, and whoami exe. Rather than query for each of these commands individually, you would like to use a single query with all of them. What Splunk operator is needed to complete the following query?
- A. AND
- B. NOT
- C. OR
- D. IN
Answer: C
Explanation:
The OR operator is needed to complete the following query, as it allows to search for events that match any of the specified values. The query would look like this:
event_simpleName=ProcessRollup2 FileName=net.exe OR FileName=ipconfig.exe OR FileName=whoami.exe The OR operator is used to combine multiple search terms or expressions and return events that match at least one of them. The IN, NOT, and AND operators are not suitable for this query, as they have different functions and meanings.
NEW QUESTION # 37
Which of the following is an example of actor actions during the RECONNAISSANCE phase of the Cyber Kill Chain?
- A. Emailing the intended victim with a malware attachment
- B. Installing a backdoor on the victim endpoint
- C. Loading a malicious payload into a common DLL
- D. Discovering internet-facing servers
Answer: D
Explanation:
Discovering internet-facing servers is an example of actor actions during the RECONNAISSANCE phase of the Cyber Kill Chain. The RECONNAISSANCE phase is where the adversary researches and identifies targets, vulnerabilities, and attack vectors. Discovering internet-facing servers is a way for the adversary to find potential entry points or weaknesses in the target network.
NEW QUESTION # 38
Which of the following is a recommended technique to find unique outliers among a set of data in the Falcon Event Search?
- A. Stacking (Frequency Analysis)
- B. Machine Learning
- C. Time-based Searching
- D. Hunt-and-Peck Search Methodology
Answer: A
Explanation:
Stacking (Frequency Analysis) is a recommended technique to find unique outliers among a set of data in the Falcon Event Search. As explained above, stacking involves grouping events by a common attribute and counting their frequency, then sorting them by ascending or descending order to identify rare or common events. This can help find anomalies or deviations from normal behavior that could indicate malicious activity. Hunt-and-Peck Search Methodology, Time-based Searching, and Machine Learning are not specific techniques to find unique outliers among a set of data.
NEW QUESTION # 39
You need details about key data fields and sensor events which you may expect to find from Hosts running the Falcon sensor. Which documentation should you access?
- A. Event stream APIs
- B. Hunting and Investigation
- C. Events Data Dictionary
- D. Streaming API Event Dictionary
Answer: C
Explanation:
The Events Data Dictionary found in the Falcon documentation is useful for writing hunting queries because it provides a reference of information about the events found in the Investigate > Event Search page of the Falcon Console. The Events Data Dictionary describes each event type, field name, data type, description, and example value that can be used to query and analyze event data. The Streaming API Event Dictionary, Hunting and Investigation, and Event stream APIs are not documentation that provide details about key data fields and sensor events.
NEW QUESTION # 40
To view Files Written to Removable Media within a specified timeframe on a host within the Host Search page, expand and refer to the _______dashboard panel.
- A. Suspicious File Activity
- B. Processes and Services
- C. Registry, Tasks, and Firewall
- D. Command Line and Admin Tools
Answer: A
Explanation:
To view Files Written to Removable Media within a specified timeframe on a host within the Host Search page, you need to expand and refer to the Suspicious File Activity dashboard panel. The Suspicious File Activity dashboard panel shows information such as files written to removable media, files written to system directories by non-system processes, files written to startup folders, etc. The other dashboard panels do not show files written to removable media.
NEW QUESTION # 41
......
CrowdStrike CCFH-202b Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
CCFH-202b Exam Questions Get Updated [2026] with Correct Answers: https://prepaway.vcetorrent.com/CCFH-202b-valid-vce-torrent.html