Online Access Free CCFH-202 Exam Questions

Which of the following is an example of actor actions during the RECONNAISSANCE phase of the Cyber Kill Chain?

• A.Discovering internet-facing servers
• B.Installing a backdoor on the victim endpoint
• C.Loading a malicious payload into a common DLL
• D.Emailing the intended victim with a malware attachment

The Events Data Dictionary found in the Falcon documentation is useful for writing hunting queries because:

• A.It provides a list of all the detect names and descriptions found in the Falcon Cloud
• B.It provides pre-defined queries you can customize to meet your specific threat hunting needs
• C.It provides a reference of information about the events found in the Investigate > Event Search page of the Falcon Console
• D.It provides a list of compatible splunk commands used to query event data

Which threat framework allows a threat hunter to explore and model specific adversary tactics and techniques, with links to intelligence and case studies?

• A.Director of National Intelligence Cyber Threat Framework
• B.MITRE ATT&CK
• C.Lockheed Martin Cyber Kill Chain
• D.NIST 800-171 Cyber Threat Framework

To view Files Written to Removable Media within a specified timeframe on a host within the Host Search page, expand and refer to the _______dashboard panel.

• A.Command Line and Admin Tools
• B.Registry, Tasks, and Firewall
• C.Suspicious File Activity
• D.Processes and Services

Which of the following would be the correct field name to find the name of an event?

• A.EVENT_SIMPLE_NAME
• B.event_simpleName
• C.Event_SimpleName
• D.Event_Simple_Name