CrowdStrike CCFH-202 - CrowdStrike Certified Falcon Hunter Exam
Page: 3 / 18
Total 88 questions
Question #11 (Topic: Exam A)
Which of the following would be the correct field name to find the name of an event?
A. Event_SimpleName
B. Event_Simple_Name
C. EVENT_SIMPLE_NAME
D. event_simpleName
Answer: C
Question #12 (Topic: Exam A)
Event Search data is recorded with which time zone?
A. PST
B. GMT
C. EST
D. UTC
Answer: D
Question #13 (Topic: Exam A)
Which of the following Event Search queries would only find the DNS lookups to the domain: www.randomdomain.com?
A. event_simpleName=DnsRequest DomainName=www.randomdomain.com
B. event_simpleName=DnsRequest DomainName=randomdomain.com ComputerName=localhost
C. Dns=randomdomain.com
D. ComputerName=localhost DnsRequest “randomdomain.com”
Answer: A
Question #14 (Topic: Exam A)
How do you rename fields while using transforming commands such as table, chart, and stats?
A. By renaming the fields with the “rename” command after the transforming command. e.g. “stats count by ComputerName | rename count AS total_count”
B. You cannot rename fields as it would affect sub-queries and statistical analysis
C. By using the “renamed” keyword after the field name. e.g. “stats count renamed totalcount by ComputerName”
D. By specifying the desired name after the field name. e.g. “stats count totalcount by ComputerName”
Answer: D
Question #15 (Topic: Exam A)
SPL (Splunk) eval statements can be used to convert Unix times (Epoch) into UTC readable time. Which eval function is correct?
A. now
B. typeof
C. strftime
D. relative_time
Answer: C
