What is the primary purpose of the event timeline in Falcon Investigate?

To list all saved searches created by the analyst

To show the sequence of events leading up to and following a detection

To display the current status of all Falcon sensors in the environment

To provide a summary of the organization's overall security posture

When viewing a detection's details in Falcon, what type of information would you expect to find?

The full command line, user, and host associated with the detection

A list of all network connections made by every host in the environment

The complete source code of the Falcon sensor

The personal information of all users in the organization

A threat hunter wants to identify all detections in the Falcon platform that occurred in the last 24 hours, involved a specific user account, and were triggered on hosts in the 'Finance' group. The hunter needs to quickly narrow down the list and then investigate each detection. Which set of actions should the hunter take in the Investigate module?

Navigate to the host entity page for each host in the Finance group and review recent detections.

Use the search bar to query for the user name, then apply a time filter for the last 24 hours and a host group filter for 'Finance'.

Create a saved search for the user name and then export all results to a report.

Use the graph view to search for the user and expand all related detections.

In the Falcon Investigate module, what is the primary function of the search bar?

To create and manage custom detection rules

To initiate real-time response sessions on endpoints

To submit queries that retrieve events, detections, and other data across the Falcon platform

To configure alert notification preferences for the organization

What is the primary purpose of the graph view in Falcon Investigate?

To visualize relationships between entities and events

To list all saved searches in a visual format

To show the performance metrics of the Falcon platform

To display the geographic location of Falcon sensors

CrowdStrikeCertified Falcon Hunter (CCFH)

Domain 3Objective 2

3.2 Differentiate Use of Investigate Module Tools Available in Falcon CCFH Practice Questions (Page 1)

Part of the Search and Investigation Tools domain, which makes up ~12% of our current practice bank.

29questions here

6free pages

9concepts

Questions 1–5

1foundation · easy
What is the primary purpose of the event timeline in Falcon Investigate?
Select an answer first
2foundation · easy
When viewing a detection's details in Falcon, what type of information would you expect to find?
Select an answer first
3application · medium
A threat hunter wants to identify all detections in the Falcon platform that occurred in the last 24 hours, involved a specific user account, and were triggered on hosts in the 'Finance' group. The hunter needs to quickly narrow down the list and then investigate each detection. Which set of actions should the hunter take in the Investigate module?
Select an answer first
4foundation · easy
In the Falcon Investigate module, what is the primary function of the search bar?
Select an answer first
5foundation · easy
What is the primary purpose of the graph view in Falcon Investigate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCFH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFH” is a trademark of its owner, used for identification only.