Online Access Free CCFH-202b Exam Questions

The Events Data Dictionary found in the Falcon documentation is useful for writing hunting queries because:

• A.It provides a list of all the detect names and descriptions found in the Falcon Cloud
• B.It provides pre-defined queries you can customize to meet your specific threat hunting needs
• C.It provides a reference of information about the events found in the Investigate > Event Search page of the Falcon Console
• D.It provides a list of compatible splunk commands used to query event data

Which field should you reference in order to find the system time of a *FileWritten event?

• A.ProcessStartTime_decimal
• B.FileTimeStamp_decimal
• C.ContextTimeStamp_decimal
• D.timestamp

Which of the following is an example of actor actions during the RECONNAISSANCE phase of the Cyber Kill Chain?

• A.Installing a backdoor on the victim endpoint
• B.Emailing the intended victim with a malware attachment
• C.Loading a malicious payload into a common DLL
• D.Discovering internet-facing servers

Which tool allows a threat hunter to populate and colorize all known adversary techniques in a single view?

• A.MISP
• B.OpenXDR
• C.OWASP Threat Dragon
• D.MITRE ATT&CK Navigator

How do you rename fields while using transforming commands such as table, chart, and stats?

• A.You cannot rename fields as it would affect sub-queries and statistical analysis
• B.By using the "renamed" keyword after the field name eg "stats count renamed totalcount by ComputerName"
• C.By specifying the desired name after the field name eg "stats count totalcount by ComputerName"
• D.By renaming the fields with the "rename" command after the transforming command e.g. "stats count by ComputerName | rename count AS total_count"