Free CrowdStrike CCFH-202 Exam Dumps Questions & Answers

Which of the following is TRUE about a Hash Search?

• A.The Hash Search is available on Linux
• B.The Hash Search provides Process Execution History
• C.Module Load History is not presented in a Hash Search
• D.Wildcard searches are not permitted with the Hash Search

How do you rename fields while using transforming commands such as table, chart, and stats?

• A.By specifying the desired name after the field name eg "stats count totalcount by ComputerName"
• B.By using the "renamed" keyword after the field name eg "stats count renamed totalcount by ComputerName"
• C.By renaming the fields with the "rename" command after the transforming command e.g. "stats count by ComputerName | rename count AS total_count"
• D.You cannot rename fields as it would affect sub-queries and statistical analysis

Which of the following would be the correct field name to find the name of an event?

• A.Event_SimpleName
• B.EVENT_SIMPLE_NAME
• C.Event_Simple_Name
• D.event_simpleName

What is the main purpose of the Mac Sensor report?

• A.To identify endpoints that are in Reduced Functionality Mode
• B.To provide a dashboard for Mac related detections
• C.To provide vulnerability assessment for Mac Operating Systems
• D.To provide a summary view of selected activities on Mac hosts

SPL (Splunk) eval statements can be used to convert Unix times (Epoch) into UTC readable time Which eval function is correct^

• A.now
• B.relative time
• C.typeof
• D.strftime