CCFH-202b

CCFH-202b practice questions, page 2 of 4, with answer review and explanations.

Question 6

What is the purpose of this query?

  1. Display all locations for local subnets on a map
  2. Display geolocation data for all network logins on a map
  3. Display all users who are logging in from private IP ranges on a map
  4. Display geolocation data for RDP connections on a map

Question 7

Refer to the image.Why are there six pending containment events?

  1. When requesting containment of a device, there is one event to contain the host by Agent ID, and another event to contain by Mac Address
  2. When requesting containment of a device, there is one event for the change request, and another corresponding to the completed status of the request
  3. When requesting containment of a device, there is one event for checking of the current host state, and another corresponding to the change request0
  4. When requesting containment of a device, there is one event to contain the host by Agent ID, and another event to contain by Host Name

Question 8

Falcon is generating detections for a malicious file evil.exe with varying filepaths on several hosts as end users attempt to execute the file.Which query can be used to proactively hunt where the file exists prior to the user executing it?

Question 9

Which CQL query would output relevant data in tracking USB storage device usage?

Question 10

During an investigation you suspect that wget is used broadly to pull commands from C2 servers with public IP addresses.How can you generate an overview of all those addresses?