[2026年09月17日] 最新CCFH-202b試験問題集には高得点で一発合格
無料提供中CCFH-202bブレーン問題集とCCFH-202bリアル試験問題
CrowdStrike CCFH-202b 認定試験の出題範囲：
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
| トピック 4 |
|
| トピック 5 |
|
質問 # 15
What is the difference between a Host Search and a Host Timeline?
- A. Host Search is used for detection investigation and Host Timeline is used for proactive hunting
- B. A Host Search organizes the data in useful event categories like process executions and network connections, a Host Timeline provides an uncategorized view of recorded events in chronological order
- C. You access a Host Search from a detection to show you every recorded process event related to the detection and you can only populate the Host Timeline fields manually
- D. There is no difference. You just get to them different ways
正解：B
解説：
This is the difference between a Host Search and a Host Timeline. A Host Search is an Investigate tool that allows you to view events by category, such as process executions, network connections, file writes, etc. A Host Timeline is an Investigate tool that allows you to view all events in chronological order, without any categorization. Both tools can be used for detection investigation and proactive hunting, depending on the use case and preference. You can access a Host Search from a detection or manually enter the host details. You can also populate the Host Timeline fields manually or from other pages in Falcon.
質問 # 16
Adversaries commonly execute discovery commands such as netexe, ipconfig.exe, and whoami exe. Rather than query for each of these commands individually, you would like to use a single query with all of them. What Splunk operator is needed to complete the following query?
- A. AND
- B. NOT
- C. OR
- D. IN
正解：C
解説：
The OR operator is needed to complete the following query, as it allows to search for events that match any of the specified values. The query would look like this:
event_simpleName=ProcessRollup2 FileName=net.exe OR FileName=ipconfig.exe OR FileName=whoami.exe The OR operator is used to combine multiple search terms or expressions and return events that match at least one of them. The IN, NOT, and AND operators are not suitable for this query, as they have different functions and meanings.
質問 # 17
Which of the following is the proper method to quantify search results, enabling a hunter to quickly sort and identify outliers?
- A. Using the "|stats count" command at the end of a search string in Event Search
- B. Using the "|eval" command at the end of a search string in Event Search
- C. Exporting Event Search results to a spreadsheet and aggregating the results
- D. Using the "| stats count by" command at the end of a search string in Event Search
正解：D
解説：
This is the proper method to quantify search results, enabling a hunter to quickly sort and identify outliers. The stats command is used to calculate summary statistics on the results of a search or subsearch, such as count, sum, average, etc. The count by option is used to count the number of events for each distinct value of a field or fields and display them in a table. This can help find rare or common values that could indicate anomalies or deviations from normal behavior.
質問 # 18
What elements are required to properly execute a Process Timeline?
- A. Agent ID (AID) only
- B. Agent ID (AID) and Target Process ID
- C. Hostname and Local Process ID
- D. Target Process ID only
正解：B
解説：
The Agent ID (AID) and the Target Process ID are the elements that are required to properly execute a Process Timeline. The Agent ID (AID) is a unique identifier for each host that has a Falcon sensor installed. The Target Process ID is the decimal representation of the process identifier for the process that you want to investigate. These two elements are used to query the cloud for the events related to the process on the host. The Agent ID (AID) only, the Hostname and Local Process ID, and the Target Process ID only are not sufficient to execute a Process Timeline.
質問 # 19
What kind of activity does a User Search help you investigate?
- A. A list of DNS queries by the specified user account
- B. A count of failed user logon activity
- C. A history of Falcon Ul logon activity
- D. A list of process activity executed by the specified user account
正解：D
解説：
User Search is an Investigate tool that helps you investigate a list of process activity executed by the specified user account. It shows information such as process name, command line, parent process name, parent command line, etc. for each process that was executed by the user account on any host in your environment. It does not show a history of Falcon UI logon activity, a count of failed user logon activity, or a list of DNS queries by the specified user account.
質問 # 20
Which of the following does the Hunting and Investigation Guide contain?
- A. Example Event Search queries useful for Falcon platform configuration
- B. A list of all event types and their syntax
- C. Example Event Search queries useful for threat hunting
- D. A list of all event types specifically used for hunting and their syntax
正解：C
解説：
The Hunting and Investigation guide contains example Event Search queries useful for threat hunting. These queries are based on common threat hunting use cases and scenarios, such as finding suspicious processes, network connections, registry activity, etc. The guide also explains how to customize and modify the queries to suit different needs and environments. The guide does not contain a list of all event types and their syntax, as that information is provided in the Events Data Dictionary. The guide also does not contain example Event Search queries useful for Falcon platform configuration, as that is not the focus of the guide.
質問 # 21
What information is provided when using IP Search to look up an IP address?
- A. Suspicious IP addresses
- B. Both internal and external IPs
- C. External IPs only
- D. Internal IPs only
正解：C
解説：
IP Search is an Investigate tool that allows you to look up information about external IPs only. It shows information such as geolocation, network connection events, detection history, etc. for each external IP address that has communicated with your hosts. It does not show information about internal IPs, suspicious IPs, or both internal and external IPs.
質問 # 22
Which of the following best describes the purpose of the Mac Sensor report?
- A. The Mac Sensor report provides a comprehensive view of activities occurring on Mac hosts, including items of interest that may be hunting or investigation leads
- B. The Mac Sensor report provides a detection focused view of known malicious activities occurring on Mac hosts, including machine-learning and indicator-based detections
- C. The Mac Sensor report displays a listing of all Mac hosts with a Falcon sensor installed
- D. The Mac Sensor report displays a listing of all Mac hosts without a Falcon sensor installed
正解：A
解説：
This is the correct answer for the same reason as above. The Mac Sensor report provides a comprehensive view of activities occurring on Mac hosts, including items of interest that may be hunting or investigation leads. It does not display a listing of all Mac hosts with or without a Falcon sensor installed, nor does it provide a detection focused view of known malicious activities occurring on Mac hosts.
質問 # 23
Lateral movement through a victim environment is an example of which stage of the Cyber Kill Chain?
- A. Exploitation
- B. Actions on Objectives
- C. Delivery
- D. Command & Control
正解：D
解説：
Lateral movement through a victim environment is an example of the Command & Control stage of the Cyber Kill Chain. The Cyber Kill Chain is a model that describes the phases of a cyber attack, from reconnaissance to actions on objectives. The Command & Control stage is where the adversary establishes and maintains communication with the compromised systems and moves laterally to expand their access and control.
質問 # 24
To view Files Written to Removable Media within a specified timeframe on a host within the Host Search page, expand and refer to the _______dashboard panel.
- A. Registry, Tasks, and Firewall
- B. Processes and Services
- C. Suspicious File Activity
- D. Command Line and Admin Tools
正解：C
解説：
To view Files Written to Removable Media within a specified timeframe on a host within the Host Search page, you need to expand and refer to the Suspicious File Activity dashboard panel. The Suspicious File Activity dashboard panel shows information such as files written to removable media, files written to system directories by non-system processes, files written to startup folders, etc. The other dashboard panels do not show files written to removable media.
質問 # 25
The Process Timeline Events Details table will populate the Parent Process ID and the Parent File columns when the cloudable Event data contains which event field?
- A. RawProcessld_decimal
- B. ContextProcessld_decimal
- C. ParentProcessld_decimal
- D. RpcProcessld_decimal
正解：C
解説：
The ParentProcessld_decimal event field is what the Process Timeline Events Details table will populate the Parent Process ID and the Parent File columns with when the cloudable Event data contains it. The ParentProcessld_decimal event field is the decimal representation of the process identifier for the parent process of the target process. It can be used to trace the process ancestry and identify potential malicious activity. The ContextProcessld_decimal, RawProcessld_decimal, and RpcProcessld_decimal event fields are not used to populate the Parent Process ID and the Parent File columns.
質問 # 26
How do you rename fields while using transforming commands such as table, chart, and stats?
- A. By using the "renamed" keyword after the field name eg "stats count renamed totalcount by ComputerName"
- B. You cannot rename fields as it would affect sub-queries and statistical analysis
- C. By renaming the fields with the "rename" command after the transforming command e.g. "stats count by ComputerName | rename count AS total_count"
- D. By specifying the desired name after the field name eg "stats count totalcount by ComputerName"
正解：C
解説：
The rename command is used to rename fields while using transforming commands such as table, chart, and stats. It can be used after the transforming command and specify the old and new field names with the AS keyword. You can rename fields as it would not affect sub-queries and statistical analysis, as long as you use the correct field names in your queries. The renamed keyword and the desired name after the field name are not valid ways to rename fields.
質問 # 27
In the MITRE ATT&CK Framework (version 11 - the newest version released in April 2022), which of the following pair of tactics is not in the Enterprise: Windows matrix?
- A. Privilege Escalation and Initial Access
- B. Persistence and Execution
- C. Impact and Collection
- D. Reconnaissance and Resource Development
正解：D
解説：
Reconnaissance and Resource Development are two tactics that are not in the Enterprise: Windows matrix of the MITRE ATT&CK Framework (version 11). These two tactics are part of the PRE-ATT&CK matrix, which covers the actions that adversaries take before compromising a target. The Enterprise: Windows matrix covers the actions that adversaries take after gaining initial access to a Windows system. Persistence, Execution, Impact, Collection, Privilege Escalation, and Initial Access are all tactics that are in the Enterprise: Windows matrix.
質問 # 28
Which of the following Event Search queries would only find the DNS lookups to the domain: www randomdomain com?
- A. event_simpleName=DnsRequest DomainName=www randomdomain com
- B. event_simpleName=DnsRequest DomainName=randomdomain com ComputerName=localhost
- C. ComputerName=localhost DnsRequest "randomdomain com"
- D. Dns=randomdomain com
正解：A
解説：
This Event Search query would only find the DNS lookups to the domain www randomdomain com, as it specifies the exact event type and domain name to match. The other queries would either find other events or domains that are not relevant to the question.
質問 # 29
A benefit of using a threat hunting framework is that it:
- A. Provides high fidelity threat actor attribution
- B. Automatically generates incident reports
- C. Provides actionable, repeatable steps to conduct threat hunting
- D. Eliminates false positives
正解：C
解説：
A threat hunting framework is a methodology that guides threat hunters in planning, executing, and improving their threat hunting activities. A benefit of using a threat hunting framework is that it provides actionable, repeatable steps to conduct threat hunting in a consistent and efficient manner. A threat hunting framework does not automatically generate incident reports, eliminate false positives, or provide high fidelity threat actor attribution, as these are dependent on other factors such as data sources, tools, and analysis skills.
質問 # 30
Which of the following queries will return the parent processes responsible for launching badprogram exe?
- A. [search (ParentProcess) where name=badprogranrexe ] | table ParentProcessName _time
- B. event_simpleName=processrollup2 [search event_simpleName=processrollup2 FileName=badprogram.exe | rename TargetProcessld_decimal AS ParentProcessld_decimal | fields aid TargetProcessld_decimal] | stats count by FileName _time
- C. [search (ProcessList) where Name=badprogram.exe ] | search ParentProcessName | table ParentProcessName _time
- D. event_simpleName=processrollup2 [search event_simpleName=processrollup2 FileName=badprogram.exe | rename ParentProcessld_decimal AS TargetProcessld_decimal | fields aid TargetProcessld_decimal] | stats count by FileName _time
正解：B
解説：
This query will return the parent processes responsible for launching badprogram.exe by using a subsearch to find the processrollup2 events where FileName is badprogram.exe, then renaming the TargetProcessld_decimal field to ParentProcessld_decimal and using it as a filter for the main search, then using stats to count the occurrences of each FileName by _time. The other queries will either not return the parent processes or use incorrect field names or syntax.
質問 # 31
SPL (Splunk) eval statements can be used to convert Unix times (Epoch) into UTC readable time Which eval function is correct^
- A. now
- B. strftime
- C. relative time
- D. typeof
正解：B
解説：
The strftime eval function is used to convert Unix times (Epoch) into UTC readable time. It takes two arguments: a Unix time field and a format string that specifies how to display the time. The now, typeof, and relative_time eval functions are not used to convert Unix times into UTC readable time.
質問 # 32
The Events Data Dictionary found in the Falcon documentation is useful for writing hunting queries because:
- A. It provides a list of compatible splunk commands used to query event data
- B. It provides a list of all the detect names and descriptions found in the Falcon Cloud
- C. It provides a reference of information about the events found in the Investigate > Event Search page of the Falcon Console
- D. It provides pre-defined queries you can customize to meet your specific threat hunting needs
正解：C
解説：
This is the correct answer for the same reason as above. The Events Data Dictionary provides a reference of information about the events found in the Investigate > Event Search page of the Falcon Console, which is useful for writing hunting queries. It does not provide pre-defined queries, detect names and descriptions, or compatible splunk commands.
質問 # 33
When performing a raw event search via the Events search page, what are Event Actions?
- A. Event Actions contains the summary of actions taken by the Falcon sensor such as quarantining a file, prevent a process from executing or taking no actions and creating a detection only
- B. Event Actions are pivotable workflows including connecting to a host, pre-made event searches and pivots to other investigatory pages such as host search
- C. Event Actions is the field name that contains the event name defined in the Events Data Dictionary such as ProcessRollup, SyntheticProcessRollup, DNS request, etc
- D. Event Actions contains an audit information log of actions an analyst took in regards to a specific detection
正解：B
解説：
When performing a raw event search via the Events search page, Event Actions are pivotable workflows that allow you to perform various tasks related to the event or the host. For example, you can connect to a host using Real Time Response, run pre-made event searches based on the event type or name, or pivot to other investigatory pages such as host search, hash search, etc. Event Actions do not contain audit information log, summary of actions taken by the Falcon sensor, or the event name defined in the Events Data Dictionary.
質問 # 34
When exporting the results of the following event search, what data is saved in the exported file (assuming Verbose Mode)? event_simpleName=*Written | stats count by ComputerName
- A. The results of the Statistics tab
- B. All events in the Events tab
- C. No data Results can only be exported when the "table" command is used
- D. The text of the query
正解：A
解説：
When exporting the results of an event search, the data that is saved in the exported file depends on the mode and the tab that is selected. In this case, the mode is Verbose and the tab is Statistics, as indicated by the stats command. Therefore, the data that is saved in the exported file is the results of the Statistics tab, which shows the count of events by ComputerName. The text of the query, all events in the Events tab, and no data are not correct answers.
質問 # 35
Where would an analyst find information about shells spawned by root, Kernel Module loads, and wget/curl usage?
- A. Sensor Policy Daily report
- B. Sensor Health report
- C. Mac Sensor report
- D. Linux Sensor report
正解：D
解説：
The Linux Sensor report is where an analyst would find information about shells spawned by root, Kernel Module loads, and wget/curl usage. The Linux Sensor report is a pre-defined report that provides a summary view of selected activities on Linux hosts. It shows information such as process execution events, network connection events, file write events, etc. that occurred on Linux hosts within a specified time range. The Sensor Health report, the Sensor Policy Daily report, and the Mac Sensor report do not provide the same information.
質問 # 36
Which pre-defined reports offer information surrounding activities that typically indicate suspicious activity occurring on a system?
- A. Timeline reports
- B. Hunt reports
- C. Scheduled searches
- D. Sensor reports
正解：B
解説：
Hunt reports are pre-defined reports that offer information surrounding activities that typically indicate suspicious activity occurring on a system. They are based on common threat hunting use cases and queries, and they provide visualizations and summaries of the results. Hunt reports can help threat hunters quickly identify and investigate potential threats in their environment.
質問 # 37
In the Powershell Hunt report, what does the filtering condition of commandLine! ="*badstring* " do?
- A. Highlights "badstring" in all command lines in the output
- B. Prevents command lines containing "badstring" from being displayed
- C. Displays only the command lines containing "badstring"
- D. Highlights only the command lines containing "badstring"
正解：B
解説：
In the Powershell Hunt report, the filtering condition of commandLine! ="badstring " prevents command lines containing "badstring" from being displayed. The ! operator is used to negate or exclude a condition from the search results. The * operator is used as a wildcard to match any number of characters before or after the specified string. Therefore, commandLine! ="badstring " means to filter out any command line that has "badstring" anywhere in it. The other options are not correct, as they do not describe what the filtering condition does.
質問 # 38
......
CCFH-202b合格させる問題集でCrowdStrike24時間で試験合格できます：https://www.passtest.jp/CrowdStrike/CCFH-202b-shiken.html
CrowdStrike CCFH-202b実際の問題とブレーン問題集：https://drive.google.com/open?id=1mMyVtLuBS_8jN7Lhn2tjK7PuPrDkB_s7