CCFH-202 Exam Dumps – Try Best CCFH-202 Exam Questions from Training Expert TrainingQuiz [Q21-Q39]

NEW QUESTION 21
The help desk is reporting an increase in calls related to user accounts being locked out over the last few days. You suspect that this could be an attack by an adversary against your organization. Select the best hunting hypothesis from the following:

NEW QUESTION 22
What is the difference between a Host Search and a Host Timeline?

NEW QUESTION 23
An analyst has sorted all recent detections in the Falcon platform to identify the oldest in an effort to determine the possible first victim host What is this type of analysis called?

NEW QUESTION 24
Which of the following is a recommended technique to find unique outliers among a set of data in the Falcon Event Search?

NEW QUESTION 25
Which of the following would be the correct field name to find the name of an event?

NEW QUESTION 26
Which field in a DNS Request event points to the responsible process?

NEW QUESTION 27
Refer to Exhibit.

What type of attack would this process tree indicate?

NEW QUESTION 28
While you’re reviewing Unresolved Detections in the Host Search page, you notice the User Name column contains “hostnameS ” What does this User Name indicate?

NEW QUESTION 29
Refer to Exhibit.

Falcon detected the above file attempting to execute. At initial glance; what indicators can we use to provide an initial analysis of the file?

NEW QUESTION 30
Which of the following is TRUE about a Hash Search?

NEW QUESTION 31
Which Falcon documentation guide should you reference to hunt for anomalies related to scheduled tasks and other Windows related artifacts?

NEW QUESTION 32
Which of the following is a suspicious process behavior?

NEW QUESTION 33
How do you rename fields while using transforming commands such as table, chart, and stats?

NEW QUESTION 34
Which field should you reference in order to find the system time of a *FileWritten event?

NEW QUESTION 35
In the Powershell Hunt report, what does the “score” signify?

NEW QUESTION 36
What kind of activity does a User Search help you investigate?

NEW QUESTION 37
Where would an analyst find information about shells spawned by root, Kernel Module loads, and wget/curl usage?

NEW QUESTION 38
Which pre-defined reports offer information surrounding activities that typically indicate suspicious activity occurring on a system?

NEW QUESTION 39
Which of the following does the Hunting and Investigation Guide contain?