CCFH-202 Practice Test

CCFH-202 Practice Test practice questions, page 2 of 4, with answer review and explanations.

Question 6

A benefit of using a threat hunting framework is that it:

  1. Automatically generates incident reports
  2. Eliminates false positives
  3. Provides high fidelity threat actor attribution
  4. Provides actionable, repeatable steps to conduct threat hunting

Question 7

Which of the following is an example of a Falcon threat hunting lead?

  1. A routine threat hunt query showing process executions of single letter filename (e.g., a.exe) from temporary directories
  2. Security appliance logs showing potentially bad traffic to an unknown external IP address
  3. A help desk ticket for a user clicking on a link in an email causing their machine to become unresponsive and have high CPU usage
  4. An external report describing a unique 5 character file extension for ransomware encrypted files

Question 8

The Falcon Detections page will attempt to decode Encoded PowerShell Command line parameters when which PowerShell Command line parameter is present?

  1. -Command
  2. -Hidden
  3. -e
  4. -nop

Question 9

Which structured analytic technique contrasts different hypotheses to determine which is the best leading (prioritized) hypothesis?

  1. Model hunting framework
  2. Competitive analysis
  3. Analysis of competing hypotheses
  4. Key assumptions check

Question 10

Which SPL (Splunk) field name can be used to automatically convert Unix times (Epoch) to UTC readable time within the Falcon Event Search?

  1. utc_time
  2. conv_time
  3. _time
  4. time