Which of the following is a common method used by adversaries to gain initial access to a network?

Deploying a rootkit to maintain persistence

Exploiting a vulnerability in an internet-facing application

Clearing event logs to avoid detection

Escalating privileges from a standard user to administrator

Which of the following is an example of passive reconnaissance?

Using Shodan to search for internet-connected devices belonging to the target organization

Connecting to a target's web server and attempting to enumerate usernames via login error messages

Sending a crafted ICMP echo request to a target host to determine if it is online

Performing a port scan using Nmap to identify open services on a target server

What is the primary difference between scanning and enumeration?

Scanning is used for network mapping, while enumeration is used for vulnerability identification

Scanning is passive, while enumeration is active

Scanning identifies live hosts and open ports, while enumeration extracts detailed information such as usernames and shares

Scanning is performed by automated tools, while enumeration is performed manually

What is the purpose of persistence mechanisms in the maintaining access phase?

To gather information about the target network

To escalate privileges from a standard user to administrator

To ensure the attacker can retain access across reboots and credential changes

To cover tracks by deleting logs

Which of the following is an example of a privilege escalation technique?

Using a keylogger to capture keystrokes

Exploiting a kernel vulnerability to gain root access

Deleting system logs to hide activity

Sending a phishing email to obtain credentials

CrowdStrikeCertified Falcon Hunter (CCFH)

Domain 1Objective 1

1.1 Demonstrate Knowledge of the Cyber Kill Chain (e.g., Reconnaissance, Scanning, Enumeration, Gaining Access, Escalation of Privileges, Maintaining Access, Covering Tracks) and Recognize Intelligence Gaps CCFH Practice Questions (Page 1)

Part of the ATT&CK Frameworks domain, which makes up ~10% of our current practice bank.

18questions here

4free pages

8concepts

Questions 1–5

1foundation · easy
Which of the following is a common method used by adversaries to gain initial access to a network?
Select an answer first
2foundation · easy
Which of the following is an example of passive reconnaissance?
Select an answer first
3foundation · easy
What is the primary difference between scanning and enumeration?
Select an answer first
4foundation · easy
What is the purpose of persistence mechanisms in the maintaining access phase?
Select an answer first
5foundation · easy
Which of the following is an example of a privilege escalation technique?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCFH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFH” is a trademark of its owner, used for identification only.