CCFH-202b Exam Study Guide Free Practice Test LAST UPDATED DATE Jun 04, 2026
The New CCFH-202b 2026 Updated Verified Study Guides & Best Courses
CrowdStrike CCFH-202b Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
NEW QUESTION # 17
The help desk is reporting an increase in calls related to user accounts being locked out over the last few days. You suspect that this could be an attack by an adversary against your organization. Select the best hunting hypothesis from the following:
- A. A password guessing attack is being executed against remote access mechanisms such as VPN
- B. A zero-day vulnerability is being exploited on a Microsoft Exchange server
- C. Users are locking their accounts out because they recently changed their passwords
- D. A publicly available web application has been hacked and is causing the lockouts
Answer: A
Explanation:
A hunting hypothesis is a statement that describes a possible malicious activity that can be tested with data and analysis. A good hunting hypothesis should be specific, testable, and relevant to the problem or goal. In this case, the best hunting hypothesis from the following is that a password guessing attack is being executed against remote access mechanisms such as VPN, as it explains the possible cause and method of the user account lockouts in a specific and testable way. A zero-day vulnerability on a Microsoft Exchange server is too vague and does not explain how it relates to the lockouts. A hacked web application is also too vague and does not specify how it causes the lockouts. Users locking their accounts out because they recently changed their passwords is not a malicious activity and does not account for the increase in calls.
NEW QUESTION # 18
Which structured analytic technique contrasts different hypotheses to determine which is the best leading (prioritized) hypothesis?
- A. Key assumptions check
- B. Model hunting framework
- C. Competitive analysis
- D. Analysis of competing hypotheses
Answer: D
Explanation:
Analysis of competing hypotheses is a structured analytic technique that contrasts different hypotheses to determine which is the best leading (prioritized) hypothesis. It involves listing all the possible hypotheses, identifying the evidence and assumptions for each hypothesis, evaluating the consistency and reliability of the evidence and assumptions, and rating the likelihood of each hypothesis based on the evidence and assumptions.
NEW QUESTION # 19
Lateral movement through a victim environment is an example of which stage of the Cyber Kill Chain?
- A. Exploitation
- B. Actions on Objectives
- C. Delivery
- D. Command & Control
Answer: D
Explanation:
Lateral movement through a victim environment is an example of the Command & Control stage of the Cyber Kill Chain. The Cyber Kill Chain is a model that describes the phases of a cyber attack, from reconnaissance to actions on objectives. The Command & Control stage is where the adversary establishes and maintains communication with the compromised systems and moves laterally to expand their access and control.
NEW QUESTION # 20
What information is provided from the MITRE ATT&CK framework in a detection's Execution Details?
- A. Technique ID
- B. Triggering Indicator
- C. Command Line
- D. Grouping Tag
Answer: A
Explanation:
Technique ID is the information that is provided from the MITRE ATT&CK framework in a detection's Execution Details. Technique ID is a unique identifier for each technique in the MITRE ATT&CK framework, such as T1059 for Command and Scripting Interpreter or T1566 for Phishing. Technique ID helps to map a detection to a specific adversary behavior and tactic. Grouping Tag, Command Line, and Triggering Indicator are not information that is provided from the MITRE ATT&CK framework in a detection's Execution Details.
NEW QUESTION # 21
Which of the following is a recommended technique to find unique outliers among a set of data in the Falcon Event Search?
- A. Stacking (Frequency Analysis)
- B. Time-based Searching
- C. Hunt-and-Peck Search Methodology
- D. Machine Learning
Answer: A
Explanation:
Stacking (Frequency Analysis) is a recommended technique to find unique outliers among a set of data in the Falcon Event Search. As explained above, stacking involves grouping events by a common attribute and counting their frequency, then sorting them by ascending or descending order to identify rare or common events. This can help find anomalies or deviations from normal behavior that could indicate malicious activity. Hunt-and-Peck Search Methodology, Time-based Searching, and Machine Learning are not specific techniques to find unique outliers among a set of data.
NEW QUESTION # 22
How do you rename fields while using transforming commands such as table, chart, and stats?
- A. You cannot rename fields as it would affect sub-queries and statistical analysis
- B. By using the "renamed" keyword after the field name eg "stats count renamed totalcount by ComputerName"
- C. By specifying the desired name after the field name eg "stats count totalcount by ComputerName"
- D. By renaming the fields with the "rename" command after the transforming command e.g. "stats count by ComputerName | rename count AS total_count"
Answer: D
Explanation:
The rename command is used to rename fields while using transforming commands such as table, chart, and stats. It can be used after the transforming command and specify the old and new field names with the AS keyword. You can rename fields as it would not affect sub-queries and statistical analysis, as long as you use the correct field names in your queries. The renamed keyword and the desired name after the field name are not valid ways to rename fields.
NEW QUESTION # 23
You are reviewing a list of domains recently banned by your organization's acceptable use policy. In particular, you are looking for the number of hosts that have visited each domain. Which tool should you use in Falcon?
- A. Bulk Domain Search
- B. Allowed Domain Summary Report
- C. IP Addresses Search
- D. Create a custom alert for each domain
Answer: A
Explanation:
Bulk Domain Search is the tool that you should use in Falcon to review a list of domains recently banned by your organization's acceptable use policy and look for the number of hosts that have visited each domain. Bulk Domain Search is an Investigate tool that allows you to search for multiple domains at once and view their network connection events across all hosts in your environment. It shows information such as domain name, number of hosts visited, number of detections generated, etc. for each domain. Create a custom alert for each domain, Allowed Domain Summary Report, and IP Addresses Search are not tools that you should use for this purpose.
NEW QUESTION # 24
Refer to Exhibit.
Falcon detected the above file attempting to execute. At initial glance; what indicators can we use to provide an initial analysis of the file?
- A. File name, path, Local and Global prevalence within the environment
- B. VirusTotal, Hybrid Analysis, and Google pivot indicator lights enabled
- C. Local prevalence, IOC Management action, and Event Search
- D. File path, hard disk volume number, and IOC Management action
Answer: A
Explanation:
The file name, path, Local and Global prevalence are indicators that can provide an initial analysis of the file without relying on external sources or tools. The file name can indicate the purpose or origin of the file, such as if it is a legitimate application or a malicious payload. The file path can indicate where the file was located or executed from, such as if it was in a temporary or system directory. The Local and Global prevalence can indicate how common or rare the file is within the environment or across all Falcon customers, which can help assess the risk or impact of the file.
NEW QUESTION # 25
Which of the following best describes the purpose of the Mac Sensor report?
- A. The Mac Sensor report displays a listing of all Mac hosts with a Falcon sensor installed
- B. The Mac Sensor report provides a comprehensive view of activities occurring on Mac hosts, including items of interest that may be hunting or investigation leads
- C. The Mac Sensor report provides a detection focused view of known malicious activities occurring on Mac hosts, including machine-learning and indicator-based detections
- D. The Mac Sensor report displays a listing of all Mac hosts without a Falcon sensor installed
Answer: B
Explanation:
This is the correct answer for the same reason as above. The Mac Sensor report provides a comprehensive view of activities occurring on Mac hosts, including items of interest that may be hunting or investigation leads. It does not display a listing of all Mac hosts with or without a Falcon sensor installed, nor does it provide a detection focused view of known malicious activities occurring on Mac hosts.
NEW QUESTION # 26
You need details about key data fields and sensor events which you may expect to find from Hosts running the Falcon sensor. Which documentation should you access?
- A. Event stream APIs
- B. Hunting and Investigation
- C. Streaming API Event Dictionary
- D. Events Data Dictionary
Answer: D
Explanation:
The Events Data Dictionary found in the Falcon documentation is useful for writing hunting queries because it provides a reference of information about the events found in the Investigate > Event Search page of the Falcon Console. The Events Data Dictionary describes each event type, field name, data type, description, and example value that can be used to query and analyze event data. The Streaming API Event Dictionary, Hunting and Investigation, and Event stream APIs are not documentation that provide details about key data fields and sensor events.
NEW QUESTION # 27
Which of the following is a suspicious process behavior?
- A. Non-network processes (eg, notepad exe) making an outbound network connection
- B. PowerShell running an execution policy of RemoteSigned
- C. PowerShell launching a PowerShell script
- D. An Internet browser (eg, Internet Explorer) performing multiple DNS requests
Answer: A
Explanation:
Non-network processes are processes that are not expected to communicate over the network, such as notepad.exe. If they make an outbound network connection, it could indicate that they are compromised or maliciously used by an adversary. PowerShell running an execution policy of RemoteSigned is a default setting that allows local scripts to run without digital signatures. An Internet browser performing multiple DNS requests is a normal behavior for web browsing. PowerShell launching a PowerShell script is also a common behavior for legitimate tasks.
NEW QUESTION # 28
Which field in a DNS Request event points to the responsible process?
- A. ParentProcessId_decimal
- B. ContextProcessld_decimal
- C. TargetProcessld_decimal
- D. ContextProcessld_readable
Answer: D
Explanation:
The ContextProcessld_readable field in a DNS Request event points to the responsible process. The ContextProcessld_readable field is the readable representation of the process identifier for the process that initiated the DNS request. It can be used to identify which process was communicating with a specific domain or IP address. The TargetProcessld_decimal, ContextProcessld_decimal, and ParentProcessId_decimal fields do not point to the responsible process.
NEW QUESTION # 29
Which of the following does the Hunting and Investigation Guide contain?
- A. A list of all event types and their syntax
- B. A list of all event types specifically used for hunting and their syntax
- C. Example Event Search queries useful for Falcon platform configuration
- D. Example Event Search queries useful for threat hunting
Answer: D
Explanation:
The Hunting and Investigation guide contains example Event Search queries useful for threat hunting. These queries are based on common threat hunting use cases and scenarios, such as finding suspicious processes, network connections, registry activity, etc. The guide also explains how to customize and modify the queries to suit different needs and environments. The guide does not contain a list of all event types and their syntax, as that information is provided in the Events Data Dictionary. The guide also does not contain example Event Search queries useful for Falcon platform configuration, as that is not the focus of the guide.
NEW QUESTION # 30
In the Powershell Hunt report, what does the filtering condition of commandLine! ="*badstring* " do?
- A. Highlights only the command lines containing "badstring"
- B. Prevents command lines containing "badstring" from being displayed
- C. Highlights "badstring" in all command lines in the output
- D. Displays only the command lines containing "badstring"
Answer: B
Explanation:
In the Powershell Hunt report, the filtering condition of commandLine! ="badstring " prevents command lines containing "badstring" from being displayed. The ! operator is used to negate or exclude a condition from the search results. The * operator is used as a wildcard to match any number of characters before or after the specified string. Therefore, commandLine! ="badstring " means to filter out any command line that has "badstring" anywhere in it. The other options are not correct, as they do not describe what the filtering condition does.
NEW QUESTION # 31
Refer to Exhibit.
What type of attack would this process tree indicate?
- A. Brute Forcing Attack
- B. Phishing Attack
- C. Web Application Attack
- D. Man-in-the-middle Attack
Answer: B
Explanation:
This process tree indicates a phishing attack, as it shows a user opening an email attachment (outlook.exe) that launches a malicious macro (cmd.exe) that downloads and executes a payload (powershell.exe) that connects to a remote server (svchost.exe). A phishing attack is a type of social engineering attack that uses deceptive emails or messages to trick users into opening malicious attachments or links that can compromise their systems or credentials.
NEW QUESTION # 32
Which of the following is a way to create event searches that run automatically and recur on a schedule that you set?
- A. Event Search
- B. Workflows
- C. Scheduled Reports
- D. Scheduled Searches
Answer: D
Explanation:
Scheduled Searches are a way to create event searches that run automatically and recur on a schedule that you set. You can use Scheduled Searches to monitor your environment for specific conditions or patterns, generate reports or alerts, or enrich your data with additional fields or tags. Workflows, Event Search, and Scheduled Reports are not ways to create event searches that run automatically and recur on a schedule.
NEW QUESTION # 33
......
Get Prepared for Your CCFH-202b Exam With Actual 62 Questions: https://www.pass4surecert.com/CrowdStrike/CCFH-202b-practice-exam-dumps.html