Online Access Free CCFH-202b Practice Test

Which of the following Event Search queries would only find the DNS lookups to the domain: www randomdomain com?

• A.event_simpleName=DnsRequest DomainName=randomdomain com ComputerName=localhost
• B.Dns=randomdomain com
• C.event_simpleName=DnsRequest DomainName=www randomdomain com
• D.ComputerName=localhost DnsRequest "randomdomain com"

Where would an analyst find information about shells spawned by root, Kernel Module loads, and wget/curl usage?

• A.Mac Sensor report
• B.Sensor Policy Daily report
• C.Sensor Health report
• D.Linux Sensor report

What information is shown in Host Search?

• A.Intel Reports
• B.Processes and Services
• C.Prevention Policies
• D.Quarantined Files

In the MITRE ATT&CK Framework (version 11 - the newest version released in April 2022), which of the following pair of tactics is not in the Enterprise: Windows matrix?

• A.Privilege Escalation and Initial Access
• B.Impact and Collection
• C.Persistence and Execution
• D.Reconnaissance and Resource Development

You need details about key data fields and sensor events which you may expect to find from Hosts running the Falcon sensor. Which documentation should you access?

• A.Event stream APIs
• B.Streaming API Event Dictionary
• C.Events Data Dictionary
• D.Hunting and Investigation