CCFH-202b

CCFH-202b practice questions, page 3 of 4, with answer review and explanations.

Question 11

Which query will show file execution from a suspicious directory across all hosts?

Question 12

You want to find all executions of a file on older Windows operating systems. You also want to include the Windows OU and focus on OUs with highly privileged systems and users.Which query will include the file name, operating system, and OU?

Question 13

Which CQL query will show all external IP network connections but exclude internal IP network connections?

Question 14

What is the expected result of this CQL query?

  1. All user logons originating from internal IP addresses
  2. All remote user network connection events from internal IP addresses
  3. All user logons originating from external IP addresses
  4. All remote user network connection events from external IP addresses

Question 15

You want to perform a routine hunt for failed logins in your environment, specifically targeting Remote Interactive Logins.Which query will accomplish this task?

  1. #event_simpleName=RDP LogonType=3
  2. #event_simpleName=UserLogon LogonType=10
  3. #event_simpleName=UserLogon LogonType=3
  4. #event_simpleName=RDP LogonType=10