CCFH-202b問題集、CrowdStrike実際の試験問題

質問 1

What do you click to jump to a Process Timeline from many pages in Falcon, such as a Hash Search?

A. CID

B. Process Timeline Link

C. Process ID or Parent Process ID

D. PID

正解: B

解説: (PassTest メンバーにのみ表示されます)

質問 2

Which document provides information on best practices for writing Splunk-based hunting queries, predefined queries which may be customized to hunt for suspicious network connections, and predefined queries which may be customized to hunt for suspicious processes?

A. Events Data Dictionary

B. Hunting and Investigation

C. Real Time Response and Network Containment

D. Incident and Detection Monitoring

正解: B

解説: (PassTest メンバーにのみ表示されます)

質問 3

While you're reviewing Unresolved Detections in the Host Search page, you notice the User Name column contains "hostnameS " What does this User Name indicate?

A. The Falcon sensor could not determine the User Name

B. The User Name is a System User

C. The User Name is not relevant for the dashboard

D. There is no User Name associated with the event

正解: D

解説: (PassTest メンバーにのみ表示されます)

質問 4

When performing a raw event search via the Events search page, what are Event Actions?

A. Event Actions contains the summary of actions taken by the Falcon sensor such as quarantining a file, prevent a process from executing or taking no actions and creating a detection only

B. Event Actions contains an audit information log of actions an analyst took in regards to a specific detection

C. Event Actions is the field name that contains the event name defined in the Events Data Dictionary such as ProcessRollup, SyntheticProcessRollup, DNS request, etc

D. Event Actions are pivotable workflows including connecting to a host, pre-made event searches and pivots to other investigatory pages such as host search

正解: D

解説: (PassTest メンバーにのみ表示されます)

質問 5

Which of the following does the Hunting and Investigation Guide contain?

A. A list of all event types and their syntax

B. Example Event Search queries useful for threat hunting

C. Example Event Search queries useful for Falcon platform configuration

D. A list of all event types specifically used for hunting and their syntax

正解: B

解説: (PassTest メンバーにのみ表示されます)

質問 6

Which of the following is the proper method to quantify search results, enabling a hunter to quickly sort and identify outliers?

A. Using the "|eval" command at the end of a search string in Event Search

B. Using the "|stats count" command at the end of a search string in Event Search

C. Exporting Event Search results to a spreadsheet and aggregating the results

D. Using the "| stats count by" command at the end of a search string in Event Search

正解: D

解説: (PassTest メンバーにのみ表示されます)

質問 7

What topics are presented in the Hunting and Investigation Guide?

A. Detailed summary of event names, descriptions, and some key data fields for hunting and investigation

B. Recommended platform configurations and prevention settings to ensure detections are generated for hunting leads

C. Detailed tutorial on writing advanced queries such as sub-searches and joins

D. Sample hunting queries, select walkthroughs and best practices for hunting with Falcon

正解: D

解説: (PassTest メンバーにのみ表示されます)

CrowdStrike Certified Falcon Hunter - CCFH-202b 模擬練習