An analyst is investigating a suspicious file that was detected on multiple hosts. The analyst wants to find all hosts that have this file and see if any other files with similar names exist on those hosts. Which Investigate module feature should the analyst use to explore the file entity?

Create a saved search for the file name and run it across all hosts.

Use the graph view to search for the file and expand all connections.

Navigate to the file entity page and review the list of hosts where the file was detected.

Use the search bar to query for the file name and review all events involving that file.

In Falcon Investigate, what does entity exploration allow an analyst to do?

Create new detection rules for the Falcon platform

Modify the configuration of Falcon sensors

Investigate hosts, users, and files to gather additional context and relationships

Generate a report of all detections in the last 30 days

An analyst has identified a new indicator of compromise (IOC) and wants to share it with the threat intelligence team. The analyst also wants to create a query that can be used to search for this IOC across all hosts. Which Investigate module feature should the analyst use?

Export the IOC details as a PDF and email it to the team.

Create a saved search for the IOC and share the search link with the threat intelligence team.

Copy the IOC value and paste it into a chat message to the team.

Use the graph view to visualize the IOC and share the graph image.

What is a facet in the context of Falcon Investigate search results?

A type of detection that indicates a false positive

A visualization that shows the relationship between entities

A category of data that can be used to further refine search results, such as host or user

A pre-defined query that is automatically run on a schedule

When analyzing an event timeline in Falcon, what should an analyst look for to understand the progression of an incident?

The number of events that have been marked as false positives

The names of all Falcon sensors that have not sent heartbeats

The total amount of data stored in the Falcon cloud

The chronological order of events and the relationships between them

CrowdStrikeCertified Falcon Hunter (CCFH)

Domain 3Objective 2

3.2 Differentiate Use of Investigate Module Tools Available in Falcon CCFH Practice Questions (Page 3)

Part of the Search and Investigation Tools domain, which makes up ~12% of our current practice bank.

29questions here

6free pages

9concepts

Questions 11–15

11application · medium
An analyst is investigating a suspicious file that was detected on multiple hosts. The analyst wants to find all hosts that have this file and see if any other files with similar names exist on those hosts. Which Investigate module feature should the analyst use to explore the file entity?
Select an answer first
12foundation · easy
In Falcon Investigate, what does entity exploration allow an analyst to do?
Select an answer first
13application · medium
An analyst has identified a new indicator of compromise (IOC) and wants to share it with the threat intelligence team. The analyst also wants to create a query that can be used to search for this IOC across all hosts. Which Investigate module feature should the analyst use?
Select an answer first
14foundation · easy
What is a facet in the context of Falcon Investigate search results?
Select an answer first
15foundation · easy
When analyzing an event timeline in Falcon, what should an analyst look for to understand the progression of an incident?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCFH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFH” is a trademark of its owner, used for identification only.