Online Access Free CCFH-202 Practice Test

When exporting the results of the following event search, what data is saved in the exported file (assuming Verbose Mode)? event_simpleName=*Written | stats count by ComputerName

• A.The text of the query
• B.No data Results can only be exported when the "table" command is used
• C.The results of the Statistics tab
• D.All events in the Events tab

Which pre-defined reports offer information surrounding activities that typically indicate suspicious activity occurring on a system?

• A.Timeline reports
• B.Sensor reports
• C.Scheduled searches
• D.Hunt reports

What Search page would help a threat hunter differentiate testing, DevOPs, or general user activity from adversary behavior?

• A.IP Search
• B.Domain Search
• C.User Search
• D.Hash Search

In the MITRE ATT&CK Framework (version 11 - the newest version released in April 2022), which of the following pair of tactics is not in the Enterprise: Windows matrix?

• A.Privilege Escalation and Initial Access
• B.Reconnaissance and Resource Development
• C.Impact and Collection
• D.Persistence and Execution

What is the main purpose of the Mac Sensor report?

• A.To provide a dashboard for Mac related detections
• B.To provide vulnerability assessment for Mac Operating Systems
• C.To provide a summary view of selected activities on Mac hosts
• D.To identify endpoints that are in Reduced Functionality Mode