A Falcon alert shows a CMD process with the command line `reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Updater /t REG_SZ /d "C:\Windows\System32\cmd.exe /c powershell -enc " /f`. What is the primary goal of this command?

Disable Windows Defender by modifying its registry settings

Establish persistence by adding a run key that executes a PowerShell command at logon

Create a scheduled task to run the command at a specific time

Change the system's time zone to evade timestamp analysis

A hunting hypothesis is 'An attacker is using CMD to perform network reconnaissance.' Which decoded command line would most directly support this hypothesis?

`cmd.exe /c mkdir C:\temp\newdir`

`cmd.exe /c del C:\temp\file.txt`

What is the primary difference between a CMD batch file and an inline CMD command?

Batch files run in a separate process, while inline commands run in the current shell.

Batch files are executed line-by-line from a file, while inline commands are executed as a single string.

Inline commands cannot use environment variables, while batch files can.

Batch files require administrator privileges, while inline commands do not.

In a CMD batch file, what does the `@echo off` line do?

It turns off the ability to use environment variables.

It redirects all output to a log file.

It disables the display of commands as they are executed.

It stops the batch file from executing further commands.

CrowdStrikeCertified Falcon Hunter (CCFH)

Domain 6Objective 5

6.5 Decode and Understand PowerShell/CMD Activity CCFH Practice Questions (Page 4)

Part of the Hunting Analytics domain, which makes up ~25% of our current practice bank.

23questions here

5free pages

8concepts

Questions 16–20

16application · medium
A Falcon alert shows a CMD process with the command line `reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Updater /t REG_SZ /d "C:\Windows\System32\cmd.exe /c powershell -enc <base64>" /f`. What is the primary goal of this command?
Select an answer first
17foundation · easy
A hunting hypothesis is 'An attacker is using CMD to perform network reconnaissance.' Which decoded command line would most directly support this hypothesis?
Select an answer first
18foundation · easy
What is the primary difference between a CMD batch file and an inline CMD command?
Select an answer first
19foundation · easy
In a CMD batch file, what does the `@echo off` line do?
Select an answer first
20foundation · easy
Which CMD command is used to display the network configuration, including IP addresses and network adapters?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCFH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFH” is a trademark of its owner, used for identification only.

6.5 Decode and Understand PowerShell/CMD Activity CCFH Practice Questions (Page 4)

Questions 16–20

A Falcon alert shows a CMD process with the command line `reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v Updater /t REG_SZ /d "C:\Windows\System32\cmd.exe /c powershell -enc <base64>" /f`. What is the primary goal of this command?

A hunting hypothesis is 'An attacker is using CMD to perform network reconnaissance.' Which decoded command line would most directly support this hypothesis?

What is the primary difference between a CMD batch file and an inline CMD command?

In a CMD batch file, what does the `@echo off` line do?

Which CMD command is used to display the network configuration, including IP addresses and network adapters?

Keep studying — Hunting Analytics