CCFH-202問題集、CrowdStrike実際の試験問題

質問 1

Which threat framework allows a threat hunter to explore and model specific adversary tactics and techniques, with links to intelligence and case studies?

A. Lockheed Martin Cyber Kill Chain

B. NIST 800-171 Cyber Threat Framework

C. Director of National Intelligence Cyber Threat Framework

D. MITRE ATT&CK

正解: D

解説: (PassTest メンバーにのみ表示されます)

質問 2

The help desk is reporting an increase in calls related to user accounts being locked out over the last few days. You suspect that this could be an attack by an adversary against your organization. Select the best hunting hypothesis from the following:

A. A password guessing attack is being executed against remote access mechanisms such as VPN

B. Users are locking their accounts out because they recently changed their passwords

C. A zero-day vulnerability is being exploited on a Microsoft Exchange server

D. A publicly available web application has been hacked and is causing the lockouts

正解: A

解説: (PassTest メンバーにのみ表示されます)

質問 3

Which of the following is a suspicious process behavior?

A. An Internet browser (eg, Internet Explorer) performing multiple DNS requests

B. Non-network processes (eg, notepad exe) making an outbound network connection

C. PowerShell running an execution policy of RemoteSigned

D. PowerShell launching a PowerShell script

正解: B

解説: (PassTest メンバーにのみ表示されます)

質問 4

Which of the following queries will return the parent processes responsible for launching badprogram exe?

A. event_simpleName=processrollup2 [search event_simpleName=processrollup2 FileName=badprogram.exe | rename ParentProcessld_decimal AS TargetProcessld_decimal | fields aid TargetProcessld_decimal] | stats count by FileName _time

B. [search (ParentProcess) where name=badprogranrexe ] | table ParentProcessName _time

C. event_simpleName=processrollup2 [search event_simpleName=processrollup2 FileName=badprogram.exe | rename TargetProcessld_decimal AS ParentProcessld_decimal | fields aid TargetProcessld_decimal] | stats count by FileName _time

D. [search (ProcessList) where Name=badprogram.exe ] | search ParentProcessName | table ParentProcessName _time

正解: C

解説: (PassTest メンバーにのみ表示されます)

質問 5

In the Powershell Hunt report, what does the filtering condition of commandLine! ="*badstring* " do?

A. Prevents command lines containing "badstring" from being displayed

B. Highlights only the command lines containing "badstring"

C. Highlights "badstring" in all command lines in the output

D. Displays only the command lines containing "badstring"

正解: A

解説: (PassTest メンバーにのみ表示されます)

質問 6

The Events Data Dictionary found in the Falcon documentation is useful for writing hunting queries because:

A. It provides a list of all the detect names and descriptions found in the Falcon Cloud

B. It provides a reference of information about the events found in the Investigate > Event Search page of the Falcon Console

C. It provides a list of compatible splunk commands used to query event data

D. It provides pre-defined queries you can customize to meet your specific threat hunting needs

正解: B

解説: (PassTest メンバーにのみ表示されます)

質問 7

What information is provided when using IP Search to look up an IP address?

A. Both internal and external IPs

B. Suspicious IP addresses

C. External IPs only

D. Internal IPs only

正解: C

解説: (PassTest メンバーにのみ表示されます)

CrowdStrike Certified Falcon Hunter - CCFH-202 模擬練習