CCFH-202 Practice Test

CCFH-202 Practice Test practice questions, page 3 of 4, with answer review and explanations.

Question 11

Which of the following would be the correct field name to find the name of an event?

  1. Event_SimpleName
  2. Event_Simple_Name
  3. EVENT_SIMPLE_NAME
  4. event_simpleName

Question 12

Event Search data is recorded with which time zone?

  1. PST
  2. GMT
  3. EST
  4. UTC

Question 13

Which of the following Event Search queries would only find the DNS lookups to the domain: www.randomdomain.com?

  1. event_simpleName=DnsRequest DomainName=www.randomdomain.com
  2. event_simpleName=DnsRequest DomainName=randomdomain.com ComputerName=localhost
  3. Dns=randomdomain.com
  4. ComputerName=localhost DnsRequest “randomdomain.com”

Question 14

How do you rename fields while using transforming commands such as table, chart, and stats?

  1. By renaming the fields with the “rename” command after the transforming command. e.g. “stats count by ComputerName | rename count AS total_count”
  2. You cannot rename fields as it would affect sub-queries and statistical analysis
  3. By using the “renamed” keyword after the field name. e.g. “stats count renamed totalcount by ComputerName”
  4. By specifying the desired name after the field name. e.g. “stats count totalcount by ComputerName”

Question 15

SPL (Splunk) eval statements can be used to convert Unix times (Epoch) into UTC readable time. Which eval function is correct?

  1. now
  2. typeof
  3. strftime
  4. relative_time