CROWDSTRIKE

CrowdStrike Certified Falcon Hunter (CCFH)

CCFH

The CrowdStrike Certified Falcon Hunter (CCFH) certification validates the skills of investigative analysts who perform deep detection analysis, machine timelining, event-related search queries, insider-threat investigations, and proactive threat hunting on the CrowdStrike Falcon platform. It is designed for security professionals who go beyond front-line response to uncover hidden threats and strengthen their organization's cyber defense. Earning the CCFH demonstrates your ability to turn Falcon platform telemetry into actionable intelligence and proactive hunting outcomes.

Practice Free Questions

7Domains

34Objectives

136Practice pages

629Free questions

CCFH free practice questions

Choose any objective and open any question page — no sign-in required.

1.1 Demonstrate knowledge of the cyber kill chain (e.g., reconnaissance, scanning, enumeration, gaining access, escalation of privileges, maintaining access, covering tracks) and recognize intelligence gaps

18 questions · 4 pages

Questions 1–5 6–10 11–15 16–18

1.2 Utilize the MITRE ATT&CK Framework to model threat actor behaviors

25 questions · 5 pages

Questions 1–5 6–10 11–15 16–20 21–25

1.3 Operationalize the MITRE ATT&CK Framework to research threat models, TTPs and threat actors, and pivot as necessary and convey to non-technical audiences

19 questions · 4 pages

Questions 1–5 6–10 11–15 16–19

2.1 Analyze information displayed in the Host Timeline to understand host states and events

22 questions · 5 pages

Questions 1–5 6–10 11–15 16–20 21–22

2.2 Analyze the information displayed in the Process Timeline to understand the flow of events and detections

28 questions · 6 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–28

2.3 Pivot from the detection page to additional investigative tools

10 questions · 2 pages

Questions 1–5 6–10

3.1 Analyze and interpret metadata around files and processes recorded by Falcon

19 questions · 4 pages

Questions 1–5 6–10 11–15 16–19

3.2 Differentiate use of Investigate Module tools available in Falcon

29 questions · 6 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–29

3.3 Understand use cases for various search options (e.g., Users, Hosts, Hash search, IP addresses, and Bulk domains)

15 questions · 3 pages

Questions 1–5 6–10 11–15

3.4 Interpret search result information displayed in dashboards to determine additional investigation or action

10 questions · 2 pages

Questions 1–5 6–10

4.1 Define key syntax of CrowdStrike Query Language (CQL)

10 questions · 2 pages

Questions 1–5 6–10

4.2 Build a query and perform a search using CQL

12 questions · 3 pages

Questions 1–5 6–10 11–12

4.3 Format event data for user readability, export or charting

18 questions · 4 pages

Questions 1–5 6–10 11–15 16–18

4.4 Filter event data and analyze results

18 questions · 4 pages

Questions 1–5 6–10 11–15 16–18

4.5 Describe the process relationship of (Target/Parent/Context)

16 questions · 4 pages

Questions 1–5 6–10 11–15 16–16

4.6 Define key data event types

18 questions · 4 pages

Questions 1–5 6–10 11–15 16–18

4.7 Convert and format Unix times to UTC readable time

14 questions · 3 pages

Questions 1–5 6–10 11–14

4.8 Create a custom dashboard to display Advanced Event Search results

13 questions · 3 pages

Questions 1–5 6–10 11–13

5.1 Use the built-in Hunt reports to refine event details

14 questions · 3 pages

Questions 1–5 6–10 11–14

5.2 Use the built-in Visibility reports to refine event details

15 questions · 3 pages

Questions 1–5 6–10 11–15

5.3 Leverage the Events Reference (Events Data Dictionary) documentation to learn information about specific events

22 questions · 5 pages

Questions 1–5 6–10 11–15 16–20 21–22

6.1 Analyze and recognize suspicious overt malicious behaviors

15 questions · 3 pages

Questions 1–5 6–10 11–15

6.2 Understand target systems (asset inventory and who would target those assets)

25 questions · 5 pages

Questions 1–5 6–10 11–15 16–20 21–25

6.3 Evaluate information for reliability, validity and relevance for use in the process of elimination

16 questions · 4 pages

Questions 1–5 6–10 11–15 16–16

6.4 Identify alternative analytical interpretations to minimize and reduce false positives

21 questions · 5 pages

Questions 1–5 6–10 11–15 16–20 21–21

6.5 Decode and understand PowerShell/CMD activity

23 questions · 5 pages

Questions 1–5 6–10 11–15 16–20 21–23

6.6 Recognize patterns such as an enterprise-wide file infection process to determine the root cause or source of the infection

19 questions · 4 pages

Questions 1–5 6–10 11–15 16–19

6.7 Differentiate testing, DevOps or general user activity from adversary behavior

26 questions · 6 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–26

6.8 Identify the vulnerability exploited from an initial attack vector

15 questions · 3 pages

Questions 1–5 6–10 11–15

7.1 Conduct routine active hunt operations within your environment in order to determine if your environment has been breached

23 questions · 5 pages

Questions 1–5 6–10 11–15 16–20 21–23

7.2 Perform outlier analysis with the Falcon tool

25 questions · 5 pages

Questions 1–5 6–10 11–15 16–20 21–25

7.3 Conduct hypothesis and hunting lead generation in order to prove them using Falcon tools

27 questions · 6 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–27

7.4 Construct simple and complex EAM queries in Falcon

5 questions · 1 pages

Questions 1–5

7.5 Investigate a process tree

24 questions · 5 pages

Questions 1–5 6–10 11–15 16–20 21–24

Want a smarter study session?Try adaptive questions aimed at your weak spots, the illustrated book, and readiness you can trust.

Continue Free Practice

Percentages reflect share of the current practice bank, not official exam weightings. Every page above is a live, crawlable practice page (34 objectives · 136 pages).

CrowdStrike Certified Falcon Hunter (CCFH)

CCFH free practice questions

Domain 1 · ATT&CK Frameworks10% of practice bank · 3 objectives · 62 questions10%

Domain 2 · Detection Analysis10% of practice bank · 3 objectives · 60 questions10%

Domain 3 · Search and Investigation Tools12% of practice bank · 4 objectives · 73 questions12%

Domain 4 · Event Search19% of practice bank · 8 objectives · 119 questions19%

Domain 5 · Reports and References8% of practice bank · 3 objectives · 51 questions8%

Domain 6 · Hunting Analytics25% of practice bank · 8 objectives · 160 questions25%

Domain 7 · Hunting Methodology17% of practice bank · 5 objectives · 104 questions17%