CROWDSTRIKECrowdStrike Certified Falcon Hunter (CCFH)
The CrowdStrike Certified Falcon Hunter (CCFH) certification validates the skills of investigative analysts who perform deep detection analysis, machine timelining, event-related search queries, insider-threat investigations, and proactive threat hunting on the CrowdStrike Falcon platform. It is designed for security professionals who go beyond front-line response to uncover hidden threats and strengthen their organization's cyber defense. Earning the CCFH demonstrates your ability to turn Falcon platform telemetry into actionable intelligence and proactive hunting outcomes.
629 practice questions · Updated 2026-08-04
7Domains
34Objectives
159Concepts
629Questions
CCFH Curriculum
Every domain, objective, and concept the CCFH exam measures.
- Cyber Kill Chain Overview
- Reconnaissance
- Scanning and Enumeration
- Gaining Access
- Escalation of Privileges
- Maintaining Access
- Covering Tracks
- Intelligence Gap Recognition
- ATT&CK Framework Overview
- Mapping Threat Actor Behaviors
- Navigating ATT&CK Matrices
- Using ATT&CK for Detection and Response
- MITRE ATT&CK Framework Overview
- Threat Model Research
- TTP Identification and Mapping
- Threat Actor Profiling
- Pivoting in Threat Research
- Communicating to Non-Technical Audiences
- Host Timeline navigation
- Event types and icons
- Event timestamps and ordering
- Host state indicators
- Event filtering and search
- Event details and context
- Correlating events with host activity
- Process Timeline layout
- Event sequence interpretation
- Process relationships
- Detection markers
- Timeline navigation
- Flow of events analysis
- Identify pivot options
- Navigate to tools
- Use pivot data
- File metadata fields
- Process metadata fields
- Correlating file and process metadata
- Using metadata for threat hunting
- Investigate Module Overview
- Search Functionality
- Filtering and Faceting
- Detection Details
- Event Timeline
- Entity Exploration
- Graph View
- Saved Searches and Reports
- Export and Collaboration
- Users search use cases
- Hosts search use cases
- Hash search use cases
- IP address search use cases
- Bulk domains search use cases
- Selecting the appropriate search option
- Dashboard result interpretation
- CQL Syntax Fundamentals
- Query Structure
- Field and Value Syntax
- Comparison Operators
- Logical Operators
- Wildcards and Special Characters
- Time Range Syntax
- Parentheses and Precedence
- CQL Syntax Fundamentals
- Query Building Blocks
- Search Execution
- Format event data for readability
- Export event data
- Chart event data
- Filter event data
- Analyze results
- Target/Parent/Context Relationship
- Process Hierarchy in Event Data
- Using Context for Investigation
- Identify key data event types
- Understand event source and purpose
- Differentiate event types
- Unix time format
- UTC time format
- Conversion methods
- Timezone considerations
- Practical application in Falcon
- Dashboard creation
- Adding Advanced Event Search results
- Dashboard configuration
- Saving and sharing dashboards
- Accessing Hunt reports
- Understanding Hunt report structure
- Refining event details
- Locate Visibility reports
- Identify report types
- Apply filters to reports
- Refine event details
- Export report data
- Locate the Events Reference
- Understand the purpose of the Events Reference
- Search for specific events
- Interpret event fields
- Apply event information
- Recognize overt malicious behaviors
- Analyze suspicious behaviors
- Correlate behaviors with attack patterns
- Prioritize alerts based on severity
- Asset Inventory Fundamentals
- Asset Value and Criticality
- Threat Actor Profiling
- Target Selection Criteria
- Asset-Target Mapping
- Reliability Assessment
- Validity Assessment
- Relevance Assessment
- Process of Elimination Application
- Alternative analytical interpretations
- False positive reduction strategies
- Contextual analysis in hunting
- PowerShell command-line basics
- CMD command-line basics
- Decoding obfuscated PowerShell
- Decoding obfuscated CMD activity
- Understanding PowerShell execution policies and contexts
- Understanding CMD batch and inline execution
- Interpreting command-line arguments and flags
- Correlating decoded activity with hunting hypotheses
- Enterprise-wide file infection pattern recognition
- Root cause analysis for file infections
- Source identification techniques
- Baseline of normal activity
- Indicators of testing activity
- Indicators of DevOps activity
- Indicators of adversary behavior
- Contextual analysis
- Tools and techniques for differentiation
- Initial Attack Vector Identification
- Vulnerability Exploitation Analysis
- Mapping Attack Vector to Vulnerability
- Routine Active Hunt Planning
- Hunt Execution Process
- Environment-Specific Hunt Tuning
- Breach Determination Criteria
- Outlier Analysis Fundamentals
- Falcon Search and Filtering
- Baseline Establishment
- Statistical and Heuristic Methods
- Visualizing Outliers
- Investigating Outlier Events
- Documenting and Reporting Outliers
- Hypothesis Generation
- Hunting Lead Sources
- Formulating Testable Hypotheses
- Mapping Hypotheses to Falcon Queries
- Iterative Hypothesis Refinement
- Proving Hypotheses with Evidence
- EAM query syntax
- Simple EAM queries
- Complex EAM queries
- EAM query optimization
- Process tree structure
- Process tree investigation workflow
- Suspicious process identification
- Process tree correlation with events
Ready to practice?Test your knowledge with exam-style questions or take an intelligent quiz tailored to your level.
Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for CCFH, so none is invented.