QUESTION: 33

In which of the following stages of the Cyber Kill Chain does the actor not interact with the victim endpoint(s)?

Exploitation
Weaponization
Command & control
Installation

Answer(s): B

Reveal Solution Next Question

QUESTION: 34

What information is provided from the MITRE ATT&CK framework in a detection's Execution Details?

Grouping Tag
Command Line
Technique ID
Triggering Indicator

Answer(s): C

Reveal Solution Next Question

QUESTION: 35

You need details about key data fields and sensor events which you may expect to find from Hosts running the Falcon sensor. Which documentation should you access?

Events Data Dictionary
Streaming API Event Dictionary
Hunting and Investigation
Event stream APIs

Answer(s): A

Reveal Solution Next Question

QUESTION: 36

The Events Data Dictionary found in the Falcon documentation is useful for writing hunting queries because:

It provides pre-defined queries you can customize to meet your specific threat hunting needs
It provides a list of all the detect names and descriptions found in the Falcon Cloud
It provides a reference of information about the events found in the Investigate > Event Search page of the Falcon Console
It provides a list of compatible splunk commands used to query event data

Answer(s): C

Reveal Solution Next Question

Free CCFH-202 Exam Braindumps

QUESTION: 33

QUESTION: 34

QUESTION: 35

QUESTION: 36

CCFH-202 Discussions & Posts