An analyst executes the query `EventType='ProcessRollup2' AND UserName='admin'` and receives zero results. They know that the 'admin' user has been active on the system. What is the most likely reason for the zero results?

The time range selected in the interface does not cover the period when the user was active.

The event type 'ProcessRollup2' does not exist.

The field name 'UserName' is incorrect; it should be 'Username'.

The query is syntactically incorrect.

An analyst is investigating a potential data exfiltration incident. They want to find all network connections from a specific host to an external IP address. The event type is 'NetworkConnection'. Which query is correctly structured to find these events?

EventType='NetworkConnection' OR DestinationIP='203.0.113.5'

Hostname='host01' AND DestinationIP='203.0.113.5'

EventType='NetworkConnection' AND Hostname='host01' AND DestinationIP='203.0.113.5'

EventType='NetworkConnection' AND DestinationIP='203.0.113.5'

An analyst is investigating a suspicious process that spawned multiple child processes. They run the query `EventType='ProcessRollup2' AND ParentProcessId=1234` and get results, but they suspect some child processes are missing. They know the parent process ID is correct. What is the most likely reason for the missing results?

The query is missing the 'Success' filter.

The field name 'ParentProcessId' is incorrect.

The time range is too narrow and does not cover all the child process events.

Some child processes may have a different event type, such as 'ProcessRollup2' vs 'ProcessRollup1'.

An analyst runs a search and gets a large number of results. They want to narrow down the results to only show events from a specific host. What is the most efficient way to do this?

Export the results to a CSV file and filter in Excel.

Sort the results by hostname in the interface.

Manually scroll through the results and look for the hostname.

Add a filter for the hostname to the existing query and re-run the search.

CrowdStrikeCertified Falcon Hunter (CCFH)

Domain 4Objective 2

4.2 Build a Query and Perform a Search Using CQL CCFH Practice Questions (Page 2)

Part of the Event Search domain, which makes up ~19% of our current practice bank.

12questions here

3free pages

3concepts

Questions 6–10

6application · medium
An analyst executes the query `EventType='ProcessRollup2' AND UserName='admin'` and receives zero results. They know that the 'admin' user has been active on the system. What is the most likely reason for the zero results?
Select an answer first
7foundation · easy
In a CQL query, which operator is used to match a field value that contains a specific substring?
Select an answer first
8application · medium
An analyst is investigating a potential data exfiltration incident. They want to find all network connections from a specific host to an external IP address. The event type is 'NetworkConnection'. Which query is correctly structured to find these events?
Select an answer first
9expert · hard
An analyst is investigating a suspicious process that spawned multiple child processes. They run the query `EventType='ProcessRollup2' AND ParentProcessId=1234` and get results, but they suspect some child processes are missing. They know the parent process ID is correct. What is the most likely reason for the missing results?
Select an answer first
10application · easy
An analyst runs a search and gets a large number of results. They want to narrow down the results to only show events from a specific host. What is the most efficient way to do this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCFH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFH” is a trademark of its owner, used for identification only.

4.2 Build a Query and Perform a Search Using CQL CCFH Practice Questions (Page 2)

Questions 6–10

An analyst executes the query `EventType='ProcessRollup2' AND UserName='admin'` and receives zero results. They know that the 'admin' user has been active on the system. What is the most likely reason for the zero results?

In a CQL query, which operator is used to match a field value that contains a specific substring?

An analyst is investigating a potential data exfiltration incident. They want to find all network connections from a specific host to an external IP address. The event type is 'NetworkConnection'. Which query is correctly structured to find these events?

An analyst runs a search and gets a large number of results. They want to narrow down the results to only show events from a specific host. What is the most efficient way to do this?

Keep studying — Event Search