Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. CrowdStrike
  5. CCFH-202

CrowdStrike CCFH-202 Exam Questions
CrowdStrike Certified Falcon Hunter (Page 2 )

Updated On: 16-Feb-2026
Page 2 of 19
PDF with 88 Questions

Which of the following is a suspicious process behavior?

  1. PowerShell running an execution policy of RemoteSigned
  2. An Internet browser (eg., Internet Explorer) performing multiple DNS requests
  3. PowerShell launching a PowerShell script
  4. Non-network processes (e.g., notepad.exe) making an outbound network connection

Answer(s): D



Which field should you reference in order to find the system time of a *FileWritten event?

  1. ContextTimeStamp_decimal
  2. FileTimeStamp_decimal
  3. ProcessStartTime_decimal
  4. timestamp

Answer(s): A



What Search page would help a threat hunter differentiate testing, DevOPs, or general user activity from adversary behavior?

  1. Hash Search
  2. IP Search
  3. Domain Search
  4. User Search

Answer(s): D



An analyst has sorted all recent detections in the Falcon platform to identify the oldest in an effort to determine the possible first victim host. What is this type of analysis called?

  1. Visualization of hosts
  2. Statistical analysis
  3. Temporal analysis
  4. Machine Learning

Answer(s): C





Falcon detected the above file attempting to execute. At initial glance, what indicators can we use to provide an initial analysis of the file?

  1. VirusTotal, Hybrid Analysis, and Google pivot indicator lights enabled
  2. File name, path, Local and Global prevalence within the environment
  3. File path, hard disk volume number, and IOC Management action
  4. Local prevalence, IOC Management action, and Event Search

Answer(s): B






Post your Comments and Discuss CrowdStrike CCFH-202 exam dumps with other Community members:

Join the CCFH-202 Discussion