• Home
• CrowdStrike Exams
• CCFH-202 - CrowdStrike Certified Falcon Hunter

CCFH-202 CrowdStrike Practice Test Questions and Exam Dumps

Question 1

Which of the following is suspicious process behavior?

A. PowerShell running an execution policy of RemoteSigned
B. An Internet browser (eg., Internet Explorer) performing multiple DNS requests
C. PowerShell launching a PowerShell script
D. Non-network processes (e.g., notepad.exe) making an outbound network connection

Correct Answer D

Explanation:

Suspicious process behavior typically refers to actions that are abnormal for a particular application or system process and may indicate potential malicious activity. Let’s analyze each option in this question to determine which behavior would be considered anomalous or potentially malicious.

Option A describes PowerShell running with an execution policy of RemoteSigned. This is a normal configuration, especially in enterprise environments. It allows PowerShell scripts downloaded from the internet to run only if they are signed by a trusted publisher, while locally created scripts can run without signatures. This execution policy alone is not inherently suspicious and is commonly used to balance flexibility and security.

Option B describes an internet browser like Internet Explorer performing multiple DNS requests. This, too, is generally expected behavior. Browsers routinely perform DNS lookups as users visit websites, some of which may include embedded third-party content like ads, trackers, or scripts that require multiple DNS resolutions. Therefore, multiple DNS requests by a browser are not unusual.

Option C states that PowerShell launches a PowerShell script. PowerShell is often used by administrators for automation and scripting, and launching scripts is a normal and expected operation. While PowerShell is also a common tool for attackers, simply launching a script does not automatically make the behavior suspicious. Additional context such as obfuscated commands or network communication would be needed to categorize it as suspicious.

Option D, however, identifies non-network processes like Notepad (notepad.exe) making outbound network connections. This is highly anomalous and suspicious behavior. Notepad is a local text editing tool and should not initiate network communications under normal conditions. If Notepad or a similarly non-networking program starts making outbound connections, it may indicate that the process has been compromised by malware or is being abused by an attacker to exfiltrate data, download payloads, or establish command-and-control (C2) communications.

In the context of Endpoint Detection and Response (EDR) and behavior-based analytics, this type of behavior—non-networking processes initiating network traffic—is a common red flag and should trigger investigation.

 While options A through C represent legitimate or at least explainable activities, Option D stands out as suspicious and potentially indicative of malicious activity, making it the correct answer.

Question 2

Which field should you reference in order to find the system time of a FileWritten event?

A. ContextTimeStamp_decimal
B. FileTimeStamp_decimal
C. ProcessStartTime_decimal
D. timestamp

Correct Answer D

Explanation:

To accurately determine when a *FileWritten event occurred on a system, it is essential to reference the correct timestamp that reflects the system’s internal record of the event’s occurrence. Let’s examine the available field options and evaluate which one provides the actual system time of the *FileWritten event.

Option A: ContextTimeStamp_decimal
This field often represents a contextually adjusted timestamp, possibly relative to a process or session but not necessarily the absolute time the file write occurred. It is typically used for correlation or sequencing of related events within a specific context. While it may help understand the timeline within a grouped activity, it does not directly represent the system time of the event.

Option B: FileTimeStamp_decimal
This field usually refers to the time value embedded in the file metadata—for example, when the file itself was last modified, created, or accessed as recorded by the file system. However, this information can be manipulated by malware or user actions and may not reflect the actual time the file was written from a forensic or telemetry perspective. It is not the same as the system-generated time of the event.

Option C: ProcessStartTime_decimal
This field indicates when the process responsible for the event (such as the writing process) was started. While this can provide useful context, it is not the time of the file write itself, and it can lead to confusion if the process performs multiple actions over its lifecycle.

Option D: timestamp
This field represents the system time at which the event was recorded, as captured by the logging mechanism or telemetry sensor. For the *FileWritten event, the timestamp field is the authoritative source to determine exactly when the file was written on the system. It is generated at the moment the sensor detects the write operation and is used by security analysts and forensic investigators to build timelines and correlate activity across different events.

In threat hunting, digital forensics, or incident response workflows, the timestamp is considered the most reliable and consistent field for chronological sorting and analysis. It ensures accuracy when correlating file writes with other system events such as process executions, network connections, or registry modifications.

Question 3

What Search page would help a threat hunter differentiate testing, DevOps, or general user activity from adversary behavior?

A. Hash Search
B. IP Search
C. Domain Search
D. User Search

Correct Answer D

Explanation:

In threat hunting and security investigations, understanding who performed an action is often just as critical as understanding what action was performed. This is particularly important when trying to distinguish between legitimate behavior—such as DevOps testing or system administration tasks—and malicious activity carried out by an adversary.

Let’s evaluate each search type in the context of differentiating user behavior:

Option A: Hash Search
Hash searches are used primarily to identify whether specific files or executables were present or run in the environment. This helps track malware or suspicious binaries, but hashes are more useful for identifying what object was involved rather than who used it. It does not help differentiate between DevOps activity and adversary behavior unless context is added from other logs.

Option B: IP Search
An IP search allows a threat hunter to trace communication to and from an endpoint, potentially identifying command-and-control servers or lateral movement across a network. While this may provide insight into suspicious traffic, it does not tell us which user was responsible for initiating or authorizing that communication. It lacks user attribution.

Option C: Domain Search
Domain searches help identify suspicious domain names accessed by systems. Like IP searches, this is useful in identifying command-and-control activity, phishing callbacks, or domain abuse. But again, domains provide context about external destinations, not user-level intent or distinction between internal roles like DevOps or test users.

Option D: User Search
The User Search page is specifically designed to aggregate and display events and behaviors tied to individual user identities. By focusing on user accounts, threat hunters can distinguish between actions performed by legitimate users (such as a DevOps engineer running scripts) and potentially compromised or rogue accounts executing similar actions. This is especially useful in environments where automation scripts, testing processes, and administrative tasks may appear suspicious at a technical level but are, in fact, authorized.

For instance, PowerShell usage or registry modifications might seem malicious at first glance. However, if these actions are tied to a known DevOps account running scheduled configuration tasks, they can be safely categorized as benign. On the other hand, if similar behavior comes from a generic user account that does not usually perform such tasks, it may warrant further investigation.

The User Search page enables this level of discrimination by showing historical behaviors, login activity, and contextual data related to a specific user. It also aids in baselining normal behavior and identifying anomalies.

Thus, the most effective search page for distinguishing normal user/DevOps activity from adversarial behavior is the User Search page.

Question 4

An analyst has sorted all recent detections in the Falcon platform to identify the oldest in an effort to determine the possible first victim host. What is this type of analysis called?

A. Visualization of hosts
B. Statistical analysis
C. Temporal analysis
D. Machine Learning

Correct Answer C

Explanation:

In cybersecurity threat hunting and incident response, understanding when an event occurred is just as crucial as knowing what happened and who was involved. When an analyst sorts detections based on their timestamps to identify the oldest event—which may reveal the initial point of compromise or "patient zero"—they are performing what is known as temporal analysis.

Let’s walk through each option to clarify this distinction:

Option A: Visualization of hosts
This term refers to creating graphical or dashboard-based views of host activity, which may include charts or graphs showing host behavior over time, geographic distribution, or detection frequency. While visualization can assist in identifying anomalies, it is a tool for presenting data, not necessarily an analytic method focused on chronological order.

Option B: Statistical analysis
Statistical analysis involves the use of mathematical models to identify outliers, trends, and averages across data sets. While useful in areas such as anomaly detection or assessing alert volume, it does not inherently involve chronological sequencing of events or timeline-based insights.

Option C: Temporal analysis
Temporal analysis is specifically concerned with the time dimension of data. In threat detection and incident response, this means looking at when events occurred to establish timelines, sequence of compromises, or dwell time of an attacker. By sorting detections by age, an analyst can trace the earliest sign of compromise and identify the first victim host in a campaign. This can help determine the attacker’s initial access method and how the attack propagated.

Temporal analysis can also help identify dwell times—how long an attacker remained undetected—and whether multiple hosts were compromised simultaneously or sequentially. This insight is critical for constructing attack timelines, mapping adversary movement, and conducting root cause analysis.

Option D: Machine Learning
Machine learning refers to algorithmic methods where systems learn from data to make predictions or detect anomalies. While some security platforms incorporate ML to prioritize detections or group alerts, it is not what is being used when an analyst manually sorts events based on timestamps to determine the first compromise.

In this case, the analyst is using human reasoning guided by the temporal ordering of events, making C. Temporal analysis the correct and most precise term to describe the approach.

Question 5

Falcon detected the above file attempting to execute. At initial glance, what indicators can we use to provide an initial analysis of the file?

A. VirusTotal, Hybrid Analysis, and Google pivot indicator lights enabled
B. File name, path, Local and Global prevalence within the environment
C. File path, hard disk volume number, and IOC Management action
D. Local prevalence, IOC Management action, and Event Search

Correct Answer B

Explanation:

When a file is detected by the CrowdStrike Falcon platform, and you are conducting an initial assessment of that file, the first and most accessible data points you can analyze are often those that are directly visible from the detection pane or process details. These indicators provide the necessary context to begin evaluating whether the file represents a real threat or benign activity. The most useful elements for that purpose include:

• File name – This gives immediate insight into whether the file appears suspicious or masquerades as a legitimate process. Attackers often name malicious executables with common or misleading names (e.g., “svch0st.exe” instead of “svchost.exe”) to blend in.

• File path – Malicious files are frequently found in unusual or unauthorized directories. For instance, if a program is executing from the user’s temp folder or a hidden directory, that may warrant deeper investigation.

• Local and Global Prevalence – This refers to how often the file has been seen within the local environment (Local Prevalence) and across all CrowdStrike customers globally (Global Prevalence).

• Low local prevalence may suggest the file is new or rare in your organization.

• Low global prevalence increases suspicion that the file is not a common legitimate file but potentially a zero-day or targeted threat.

• High global prevalence might suggest a common file that is less likely to be malicious—but not always, especially if a well-distributed trojan is involved.

These three elements—file name, file path, and prevalence metrics—are among the quickest and most reliable indicators available in Falcon’s console interface to inform an initial judgment. Analysts can then decide whether to escalate the file for deeper inspection or begin containment.

Let’s compare the incorrect choices for clarity:

• Option A includes third-party tools like VirusTotal and Hybrid Analysis. While these can be valuable, they are typically used in subsequent investigation phases, not the first glance within the Falcon console itself. Also, “Google pivot indicator lights” is not a known feature in Falcon.

• Option C includes “hard disk volume number,” which provides little immediate threat context. “IOC Management action” relates to post-detection actions, not initial insight.

• Option D includes “IOC Management action” and “Event Search,” both useful for response or further investigation, but they don’t provide immediate context at the initial detection view.

Therefore, the best indicators to assess a file at first glance in Falcon are file name, file path, and local/global prevalence, making B the correct choice.

Question 6

A benefit of using a threat hunting framework is that it:

A. Automatically generates incident reports
B. Eliminates false positives
C. Provides high fidelity threat actor attribution
D. Provides actionable, repeatable steps to conduct threat hunting

Correct Answer D

Explanation:

Threat hunting frameworks are developed to assist cybersecurity professionals in conducting structured, effective, and consistent threat hunting operations. These frameworks are methodological tools that provide a foundation for hunting adversaries who have bypassed traditional defense mechanisms and are operating undetected within the environment.

The primary advantage of using such a framework is that it offers actionable, repeatable steps. These are procedures and guidelines that help threat hunters systematically approach the discovery and investigation of suspicious activities. Here’s how:

• Repeatability: Frameworks ensure that investigations are not random or ad hoc. They allow teams to replicate successful hunts, refine methodologies, and build institutional knowledge. This consistency is crucial when scaling threat hunting efforts across teams or organizations.

• Actionable Procedures: Frameworks break down hunting into discrete, manageable tasks—defining hypotheses, collecting data, analyzing events, and drawing conclusions. This allows even junior analysts to follow a logical process and mature over time.

• Examples of Hunting Frameworks: One prominent example is the MITRE ATT&CK framework, which maps adversary tactics and techniques, helping hunters form hypotheses such as "Is there evidence of credential dumping?" Other tools, like Threat Hunting Maturity Models or the Sqrrl Hunting Loop, also guide hunters through hypothesis-driven and iterative hunts.

Let’s evaluate why the other options are incorrect:

• A (Automatically generates incident reports): While some platforms may auto-generate reports, this is not a direct benefit of the hunting framework itself. Reporting is typically part of SIEM or SOAR functionalities.

• B (Eliminates false positives): No framework completely eliminates false positives. In fact, threat hunting often begins with investigating events that might be false positives in detection systems. Frameworks can help reduce them over time through better context and analysis, but they don’t eliminate them.

• C (Provides high fidelity threat actor attribution): Attribution is a separate, complex discipline often reliant on intelligence agencies or advanced threat intel teams. A framework may assist in tracking behaviors associated with threat groups (e.g., via MITRE ATT&CK), but attribution is not a guaranteed outcome of using one.

The true power of a threat hunting framework lies in enabling hunters to conduct their investigations in a systematic, effective, and repeatable manner. This structure enhances both the quality and scalability of an organization’s threat hunting capability, making D the correct and most accurate answer.

Question 7

Which of the following is an example of a Falcon threat hunting lead?

A. A routine threat hunt query showing process executions of single letter filename (e.g., a.exe) from temporary directories
B. Security appliance logs showing potentially bad traffic to an unknown external IP address
C. A help desk ticket for a user clicking on a link in an email causing their machine to become unresponsive and have high CPU usage
D. An external report describing a unique 5 character file extension for ransomware encrypted files

Correct Answer A

Explanation:

In the context of CrowdStrike Falcon and threat hunting, a "lead" refers to a starting point or hypothesis generated from available telemetry that could uncover malicious or suspicious behavior. Leads are not confirmed threats but rather patterns or anomalies identified by analysts that merit further investigation.

Option A presents such a pattern—a query result that consistently identifies process executions with single-letter filenames (e.g., a.exe) from temporary directories. This is highly suspicious behavior, often associated with malware that attempts to obfuscate its activity by using short or misleading filenames and executing from locations like C:\Users\...\Temp, which are often used during malware delivery and staging. In Falcon, custom or saved queries like this are specifically built for proactive hunting. They represent typical threat hunting leads, especially when these behaviors are identified across multiple endpoints or repeatedly over time.

Now let’s break down why the other options are not considered ideal Falcon threat hunting leads:

• B (Security appliance logs showing bad traffic): While potentially valuable, this type of data originates outside of Falcon. Threat hunting within Falcon typically relies on endpoint telemetry, such as process execution, file writes, and network activity from the Falcon sensor. External logs might be relevant in a broader incident response, but not as an internally generated Falcon lead.

• C (Help desk ticket for user clicking link): This is a reactive incident, not a proactive hunting lead. It could initiate a forensic or response process, but it is not discovered via Falcon’s hunting features or query system. Threat hunting is ideally conducted independently of already-reported incidents.

• D (External report on ransomware extension): While useful for threat intelligence, this is a signature-based IOC (Indicator of Compromise) and not a behavioral pattern derived from Falcon’s hunting telemetry. You might pivot into Falcon using this IOC, but the IOC itself is not a Falcon-originated lead.

Effective Falcon threat hunting involves writing and executing queries that target unusual behavior patterns and pivoting through telemetry to build a case. These leads are typically based on behavioral anomalies, not alerts or external intelligence alone. Therefore, option A most closely represents a legitimate Falcon threat hunting lead, based on how CrowdStrike’s platform is designed to operate.

Question 8

The Falcon Detections page will attempt to decode Encoded PowerShell Command line parameters when which PowerShell Command line parameter is present?

A. -Command
B. -Hidden
C. -e
D. -nop

Correct Answer C

Explanation:

CrowdStrike Falcon is designed to assist analysts by automatically interpreting common attacker techniques. One such technique often leveraged by adversaries is the use of encoded PowerShell commands, which can hide the true intent of a command line string and evade basic detection.

The PowerShell -EncodedCommand parameter, which can also be shortened to -e or -enc, tells PowerShell to execute a Base64-encoded string. Attackers frequently use this to obscure malicious behavior, making it more difficult for analysts or automated tools to quickly recognize threats.

Falcon’s Detections page includes built-in functionality that automatically decodes Base64-encoded PowerShell strings, but only under specific conditions—namely, when the -e (or -EncodedCommand) parameter is present in the command line. When Falcon sees this parameter, it assumes the command that follows is Base64-encoded and decodes it automatically, showing the decoded command in the detection view. This helps analysts quickly understand what was actually being executed, making threat triage and response much more efficient.

Let’s analyze why the other options are incorrect:

• A (-Command): This is a normal parameter to execute a command string in PowerShell. It doesn't indicate that the command is encoded. Falcon doesn't auto-decode based solely on -Command since there's no implication of encoding.

• B (-Hidden): This parameter is used to launch PowerShell in a hidden window. It’s a stealth technique but doesn’t deal with encoded content, so Falcon doesn’t decode anything here.

• D (-nop): This stands for “No Profile,” which disables loading of the user's PowerShell profile scripts. Again, it’s often used in attacks to minimize detection, but it doesn’t relate to encoded content, so it doesn’t trigger decoding.

Understanding how Falcon processes and decodes PowerShell activity is essential for threat hunting and incident response. It ensures that encoded commands—commonly used by attackers—are exposed to analysts clearly, aiding in faster and more accurate detection.

Thus, the Falcon Detections page will only attempt to decode the command line when it detects the -e or -EncodedCommand parameter, making C the correct answer.

Question 9

Which structured analytic technique contrasts different hypotheses to determine which is the best leading (prioritized) hypothesis?

A. Model hunting framework
B. Competitive analysis
C. Analysis of competing hypotheses
D. Key assumptions check

Correct Answer C

Explanation:

The technique best suited to evaluating multiple competing explanations or theories in a structured, unbiased way is the Analysis of Competing Hypotheses (ACH). This method is widely used in both intelligence analysis and cybersecurity threat hunting to systematically compare multiple hypotheses and identify the one that best fits the available evidence.

ACH works by listing all plausible hypotheses related to an observed behavior or event. The analyst then compiles available evidence and assesses how well each piece of evidence supports or refutes each hypothesis. This is done using a matrix or table format, helping to clearly visualize and score the strength of evidence against each possibility. The hypothesis with the least evidence contradicting it—not necessarily the one with the most supporting evidence—is usually considered the most likely. This inversion of typical reasoning helps reduce confirmation bias and promotes objective analysis.

Let’s evaluate the other options:

• A (Model hunting framework): This is not a standard structured analytic technique. While frameworks for model-based detection or threat hunting exist, they are not used specifically to contrast hypotheses as ACH does.

• B (Competitive analysis): This is typically used in business and strategic contexts to evaluate an organization’s strengths and weaknesses compared to competitors. It is not a structured technique for comparing hypotheses in a cybersecurity or threat detection context.

• D (Key assumptions check): This technique is important for validating whether an analyst’s foundational beliefs are correct. It helps to challenge the underlying assumptions in an investigation but does not itself compare hypotheses.

ACH is particularly powerful in environments like cyber threat hunting, where multiple possible explanations for suspicious behavior may exist (e.g., user error, misconfigured software, malware infection, insider threat). By helping analysts objectively rank these explanations, ACH supports more accurate decision-making and can prevent chasing false leads.

In summary, Analysis of Competing Hypotheses (ACH) is the best-suited structured technique for comparing and prioritizing multiple hypotheses based on how the available evidence aligns or contradicts them, making C the correct answer.

Question 10

Which SPL (Splunk) field name can be used to automatically convert Unix times (Epoch) to UTC readable time within the Falcon Event Search?

A. utc_time
B. conv_time
C. _time
D. time

Correct Answer C

Explanation:

When working with Falcon Event Search (which is based on Splunk), one of the most important aspects of analyzing data is dealing with timestamps. Since machine-generated logs (like those found in endpoint telemetry or Falcon detection logs) often use Unix time (also called Epoch time), it is necessary to convert this to human-readable formats—typically UTC time—for meaningful analysis.

In Splunk, the standard field used to represent the event timestamp in a readable UTC format is _time. This field is automatically interpreted and formatted by Splunk whenever raw events are ingested and indexed.

Here's why _time is the correct answer:

• The _time field is automatically assigned by Splunk based on timestamp information found in the raw event. It is displayed by default in Splunk's search results.

• This field is converted to a human-readable UTC timestamp by Splunk, even if the original data source logs timestamps in Unix format.

• Analysts can perform time-based filtering (e.g., where _time > relative_time(now(), "-24h")) directly using _time.

• In Falcon Event Search, which uses a Splunk backend, the same behavior is inherited. Thus, using _time allows threat hunters or security analysts to view and query logs using readable time values, improving the efficiency of time-correlated threat hunting.

Let’s evaluate the other options:

• A (utc_time): This is not a recognized default field in Splunk. While UTC is the format used for readability, utc_time itself isn’t a built-in or auto-populated field.

• B (conv_time): This is not a valid SPL field. It sounds like a hypothetical or custom-calculated field name but not standard in Falcon/Splunk environments.

• D (time): Although it seems plausible, time is not the field automatically interpreted and used by Splunk for timestamp conversion. The correct field for this functionality is _time.

The _time field is the built-in Splunk field that automatically parses, indexes, and displays timestamps in a human-readable UTC format. It allows effective time-based filtering and sorting within the Falcon Event Search interface. Therefore, the correct answer is C.