While investigating a host, an analyst needs to view events that occurred several hours before the current time. Which Host Timeline interface action directly supports this?

Clicking the host's name to refresh the sensor status

Adjusting the detection severity filter

Scrolling backward in the timeline to load earlier events

Selecting a different host from the Hosts page

In the Host Timeline, a Falcon Hunter sees a small icon next to an event. What is the primary purpose of these event icons?

To mark events that require immediate attention

To show the exact timestamp of the event

To indicate the severity of the event

To visually distinguish different event types at a glance

An analyst is reviewing the Host Timeline and notices that some events have a different icon than others. What does this difference most likely indicate?

The events have different severity levels

The events were generated by different sensors

The events are of different event types

The events occurred on different days

An analyst is reconstructing the sequence of events on a compromised host. The timeline shows a 'ProcessCreate' event at 10:00:00, a 'NetworkConnect' event at 10:00:05, and a 'FileWrite' event at 10:00:02. The analyst needs to determine the correct chronological order of these events. Which order is correct?

ProcessCreate, FileWrite, NetworkConnect

ProcessCreate, NetworkConnect, FileWrite

NetworkConnect, FileWrite, ProcessCreate

FileWrite, ProcessCreate, NetworkConnect

CrowdStrikeCertified Falcon Hunter (CCFH)

Domain 2Objective 1

2.1 Analyze Information Displayed in the Host Timeline to Understand Host States and Events CCFH Practice Questions (Page 4)

Part of the Detection Analysis domain, which makes up ~10% of our current practice bank.

22questions here

5free pages

7concepts

Questions 16–20

16foundation · easy
While investigating a host, an analyst needs to view events that occurred several hours before the current time. Which Host Timeline interface action directly supports this?
Select an answer first
17foundation · easy
In the Host Timeline, a Falcon Hunter sees a small icon next to an event. What is the primary purpose of these event icons?
Select an answer first
18foundation · easy
In the Host Timeline, which type of event would most directly indicate that a host was rebooted?
Select an answer first
19foundation · easy
An analyst is reviewing the Host Timeline and notices that some events have a different icon than others. What does this difference most likely indicate?
Select an answer first
20application · medium
An analyst is reconstructing the sequence of events on a compromised host. The timeline shows a 'ProcessCreate' event at 10:00:00, a 'NetworkConnect' event at 10:00:05, and a 'FileWrite' event at 10:00:02. The analyst needs to determine the correct chronological order of these events. Which order is correct?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCFH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFH” is a trademark of its owner, used for identification only.

2.1 Analyze Information Displayed in the Host Timeline to Understand Host States and Events CCFH Practice Questions (Page 4)

Questions 16–20

While investigating a host, an analyst needs to view events that occurred several hours before the current time. Which Host Timeline interface action directly supports this?

In the Host Timeline, a Falcon Hunter sees a small icon next to an event. What is the primary purpose of these event icons?

In the Host Timeline, which type of event would most directly indicate that a host was rebooted?

An analyst is reviewing the Host Timeline and notices that some events have a different icon than others. What does this difference most likely indicate?

Keep studying — Detection Analysis