CCFH-202b

CCFH-202b practice questions, page 4 of 4, with answer review and explanations.

Question 16

While performing a threat hunt in your environment, you decide to identify rare occurrences of user agent strings over the past 30 days.Which query will highlight those results using CQL?

  1. selectFromMin(field=UserAgentString, include=[ComputerName, UserName, LocalAddressIP4])
  2. groupBy(UserAgentString, function=collect([ComputerName, UserName, LocalAddressIP4]))| min(field=UserAgentString, limit=10)
  3. tail(field=UserAgentString, limit=10, include=[ComputerName, UserName, LocalAddressIP4])
  4. groupBy(UserAgentString, function=[collect([ComputerName, UserName, LocalAddressIP4)), count()])| sort( count, order=asc, limit=10)

Question 17

Which query function will output the converted time as "2021/11/26 06:54:45" where the timezone is in UTC?

  1. formattime("%A %d %B %Y, %R", as=fmttime, field=@timestamp/ timezone=Z/ unit=milliseconds)
  2. formattime("%A %d %B %Y, %R", as=fmttime, field=@timestamp, timezone=UTC, unit=milliseconds)
  3. formatTime("%Y/%m/%d %H:%M:%S", field=@timestamp, locale=en_US, timezone=Z)
  4. formatTime("%Y/%m/%d %H:%M:%S", field=@timestamp, locale=UTC)

Question 18

What will the following obfuscated command do?cmd /c "set x=^n^e^t & set y=@er & set yy=z & set z=r & set r=remove & set f=Domain+ff & set ff=Admin & g=gumball@ & echo %x%%y:@=us%/%z:r=add%%ff%%g:@=r% | cmd"

  1. Add a user named 'Admin' to the local host
  2. Remove a user name 'Admin' from the local host
  3. Add a user named 'Admin' to the Domain Admins group
  4. Change the password for a user named 'Admin' to '%g:@=r%'