CrowdStrike CCFH-202b - CrowdStrike Certified Falcon Hunter Exam
Page: 3 / 19
Total 91 questions
Question #11 (Topic: Exam A)
Which query will show file execution from a suspicious directory across all hosts?
A. 
B. 
C. 
D. 
B.
C.
D.
Answer: B
Question #12 (Topic: Exam A)
You want to find all executions of a file on older Windows operating systems. You also want to include the Windows OU and focus on OUs with highly privileged systems and users.
Which query will include the file name, operating system, and OU?
Which query will include the file name, operating system, and OU?
A. 
B. 
C. 
D. 
B.
C.
D.
Answer: B
Question #13 (Topic: Exam A)
Which CQL query will show all external IP network connections but exclude internal IP network connections?
A. 
B. 
C. 
D. 
B.
C.
D.
Answer: D
Question #14 (Topic: Exam A)
What is the expected result of this CQL query?
A. All user logons originating from internal IP addresses
B. All remote user network connection events from internal IP addresses
C. All user logons originating from external IP addresses
D. All remote user network connection events from external IP addresses
Answer: C
Question #15 (Topic: Exam A)
You want to perform a routine hunt for failed logins in your environment, specifically targeting Remote Interactive Logins.
Which query will accomplish this task?
Which query will accomplish this task?
A. #event_simpleName=RDP LogonType=3
B. #event_simpleName=UserLogon LogonType=10
C. #event_simpleName=UserLogon LogonType=3
D. #event_simpleName=RDP LogonType=10
Answer: B
