Online Access Free CCFH-202b Practice Test

Refer to Exhibit.

What type of attack would this process tree indicate?

• A.Man-in-the-middle Attack
• B.Phishing Attack
• C.Web Application Attack
• D.Brute Forcing Attack

Which of the following is an example of a Falcon threat hunting lead?

• A.A routine threat hunt query showing process executions of single letter filename (e.g., a.exe) from temporary directories
• B.An external report describing a unique 5 character file extension for ransomware encrypted files
• C.Security appliance logs showing potentially bad traffic to an unknown external IP address
• D.A help desk ticket for a user clicking on a link in an email causing their machine to become unresponsive and have high CPU usage

Which pre-defined reports offer information surrounding activities that typically indicate suspicious activity occurring on a system?

• A.Scheduled searches
• B.Hunt reports
• C.Timeline reports
• D.Sensor reports

You need details about key data fields and sensor events which you may expect to find from Hosts running the Falcon sensor. Which documentation should you access?

• A.Event stream APIs
• B.Events Data Dictionary
• C.Hunting and Investigation
• D.Streaming API Event Dictionary

Which of the following is TRUE about a Hash Search?

• A.Module Load History is not presented in a Hash Search
• B.The Hash Search is available on Linux
• C.The Hash Search provides Process Execution History
• D.Wildcard searches are not permitted with the Hash Search