Free CrowdStrike CCFH-202b Exam Dumps Questions & Answers

What information is provided from the MITRE ATT&CK framework in a detection's Execution Details?

• A.Command Line
• B.Grouping Tag
• C.Triggering Indicator
• D.Technique ID

When performing a raw event search via the Events search page, what are Event Actions?

• A.Event Actions contains an audit information log of actions an analyst took in regards to a specific detection
• B.Event Actions contains the summary of actions taken by the Falcon sensor such as quarantining a file, prevent a process from executing or taking no actions and creating a detection only
• C.Event Actions are pivotable workflows including connecting to a host, pre-made event searches and pivots to other investigatory pages such as host search
• D.Event Actions is the field name that contains the event name defined in the Events Data Dictionary such as ProcessRollup, SyntheticProcessRollup, DNS request, etc

Which tool allows a threat hunter to populate and colorize all known adversary techniques in a single view?

• A.OWASP Threat Dragon
• B.MITRE ATT&CK Navigator
• C.MISP
• D.OpenXDR

The help desk is reporting an increase in calls related to user accounts being locked out over the last few days. You suspect that this could be an attack by an adversary against your organization. Select the best hunting hypothesis from the following:

• A.A zero-day vulnerability is being exploited on a Microsoft Exchange server
• B.A publicly available web application has been hacked and is causing the lockouts
• C.Users are locking their accounts out because they recently changed their passwords
• D.A password guessing attack is being executed against remote access mechanisms such as VPN

To find events that are outliers inside a network,___________is the best hunting method to use.

• A.time-based
• B.machine learning
• C.stacking
• D.searching