CrowdStrike Certified Falcon Hunter CCFH-202b Exam Questions with Experts Answers Updated Recently

A.  

All remote user network connection events from external IP addresses

B.  

All remote user network connection events from internal IP addresses

C.  

All user logons originating from internal IP addresses

D.  

All user logons originating from external IP addresses

A.  

Indicator Activity

B.  

Command Line and ASEP Activity

C.  

Executables running from Recycle Bin

D.  

Detection Activity

A.  

groupBy(UserAgentString, function=collect([ComputerName, UserName, LocalAddressIP4])) | min(field=UserAgentString, limit=10)

B.  

selectFromMin(field=UserAgentString, include=[ComputerName, UserName, LocalAddressIP4])

C.  

groupBy(UserAgentString, function=[collect([ComputerName, UserName, LocalAddressIP4]), count()] ) | sort(_count, order=asc, limit=10)

D.  

tail(field=UserAgentString, limit=10, include=[ComputerName, UserName, LocalAddressIP4])

A.  

Monitor the Falcon Console for alerts on suspicious process activity

B.  

Analyze the Investigate Host dashboard to identify endpoints with high-risk file activity

C.  

Utilize CrowdStrike Query Language (CQL) to search for files with the same hashes that have been renamed

D.  

Utilize the IP addresses Investigate dashboard to find the hosts' processes that are connecting to an unusual IP