Online Access Free CCFH-202b Practice Test

The Process Timeline Events Details table will populate the Parent Process ID and the Parent File columns when the cloudable Event data contains which event field?

• A.RawProcessld_decimal
• B.ContextProcessld_decimal
• C.RpcProcessld_decimal
• D.ParentProcessld_decimal

You want to produce a list of all event occurrences along with selected fields such as the full path, time, username etc. Which command would be the appropriate choice?

• A.distinct count
• B.table
• C.values
• D.fields

You need details about key data fields and sensor events which you may expect to find from Hosts running the Falcon sensor. Which documentation should you access?

• A.Streaming API Event Dictionary
• B.Events Data Dictionary
• C.Hunting and Investigation
• D.Event stream APIs

You would like to search for ANY process execution that used a file stored in the Recycle Bin on a Windows host. Select the option to complete the following EAM query.

• A.*$Recycle Bin*
• B.*$Recycle Bin^
• C.^$Recycle Bin*
• D.^$Recycle.Bin%^

A benefit of using a threat hunting framework is that it:

• A.Eliminates false positives
• B.Provides actionable, repeatable steps to conduct threat hunting
• C.Provides high fidelity threat actor attribution
• D.Automatically generates incident reports