Free CrowdStrike CCFH-202 Exam Dumps Questions & Answers

Which of the following is the proper method to quantify search results, enabling a hunter to quickly sort and identify outliers?

• A.  Using the "|eval" command at the end of a search string in Event Search
• B.  Exporting Event Search results to a spreadsheet and aggregating the results
• C.  Using the "| stats count by" command at the end of a search string in Event Search
• D.  Using the "|stats count" command at the end of a search string in Event Search

You would like to search for ANY process execution that used a file stored in the Recycle Bin on a Windows host. Select the option to complete the following EAM query.

• A.  *$Recycle Bin^
• B.  ^$Recycle.Bin%^
• C.  ^$Recycle Bin*
• D.  *$Recycle Bin*

Which of the following is a way to create event searches that run automatically and recur on a schedule that you set?

• A.  Event Search
• B.  Scheduled Reports
• C.  Workflows
• D.  Scheduled Searches

To find events that are outliers inside a network,___________is the best hunting method to use.

• A.  machine learning
• B.  searching
• C.  stacking
• D.  time-based

Which of the following is TRUE about a Hash Search?

• A.  Wildcard searches are not permitted with the Hash Search
• B.  The Hash Search provides Process Execution History
• C.  The Hash Search is available on Linux
• D.  Module Load History is not presented in a Hash Search