CCFH-202 Questions | Free Practice CCFH-202 Dumps & Exam Prep

Question No 1

Which of the following is a suspicious process behavior?

Choose the Choices:

PowerShell running an execution policy of RemoteSigned

An Internet browser (eg, Internet Explorer) performing multiple DNS requests

PowerShell launching a PowerShell script

Non - network processes (eg, notepad exe) making an outbound network connection

Question No 2

Which field should you reference in order to find the system time of a *FileWritten event?

Choose the Choices:

Question No 3

What Search page would help a threat hunter differentiate testing, DevOPs, or general user activity from adversary behavior?

Choose the Choices:

Question No 4

An analyst has sorted all recent detections in the Falcon platform to identify the oldest in an effort to determine the possible first victim host What is this type of analysis called?

Choose the Choices:

Question No 5

Refer to Exhibit.

Falcon detected the above file attempting to execute. At initial glance; what indicators can we use to provide an initial analysis of the file?

Choose the Choices:

VirusTotal, Hybrid Analysis, and Google pivot indicator lights enabled

File name, path, Local and Global prevalence within the environment

File path, hard disk volume number, and IOC Management action

Local prevalence, IOC Management action, and Event Search

Free CrowdStrike CCFH-202 Questions

Question No 1

Question No 2

Question No 3

Question No 4

Question No 5

CCFH-202 Exam Features

CCFH-202 PDF Dumps