An analyst is reviewing a large dataset of 'ProcessRollup2' events and notices a single host executing 'whoami.exe', 'net user', and 'ipconfig' in quick succession. What is the most likely conclusion?

An attacker is performing host reconnaissance after initial compromise.

A user is troubleshooting a network issue.

The host is running a legitimate software installer.

A system administrator is performing routine maintenance.

An analyst filters for network connections (event_simpleName=NetworkConnection) and sees a host making repeated connections to a known malicious IP address. What is the most important additional context to gather to confirm the host is compromised?

The user who is currently logged into the host.

The physical location of the host.

The total number of connections made to the IP.

The process that initiated the connection and its command line.

A threat hunter is looking for signs of credential dumping. They want to find events where the process 'lsass.exe' was accessed by another process. Which field and value combination should they filter on to identify these access events?

event_simpleName=ProcessRollup2 AND FileName=lsass.exe

CrowdStrikeCertified Falcon Hunter (CCFH)

Domain 4Objective 4

4.4 Filter Event Data and Analyze Results CCFH Practice Questions (Page 1)

Part of the Event Search domain, which makes up ~19% of our current practice bank.

18questions here

4free pages

2concepts

Questions 1–5

1expert · medium
An analyst is reviewing a large dataset of 'ProcessRollup2' events and notices a single host executing 'whoami.exe', 'net user', and 'ipconfig' in quick succession. What is the most likely conclusion?
Select an answer first
2application · medium
A Falcon administrator needs to review all events where a specific user 'admin' performed an action on a remote host. They have the user's SID. Which filter would be most effective?
Select an answer first
3application · medium
An analyst filters for network connections (event_simpleName=NetworkConnection) and sees a host making repeated connections to a known malicious IP address. What is the most important additional context to gather to confirm the host is compromised?
Select an answer first
4application · medium
A threat hunter is looking for signs of credential dumping. They want to find events where the process 'lsass.exe' was accessed by another process. Which field and value combination should they filter on to identify these access events?
Select an answer first
5application · easy
A threat hunter wants to find all events related to a specific file hash across the environment. They have the hash 'abc123def456'. Which filter should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCFH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFH” is a trademark of its owner, used for identification only.

4.4 Filter Event Data and Analyze Results CCFH Practice Questions (Page 1)

Questions 1–5

An analyst is reviewing a large dataset of 'ProcessRollup2' events and notices a single host executing 'whoami.exe', 'net user', and 'ipconfig' in quick succession. What is the most likely conclusion?

A Falcon administrator needs to review all events where a specific user 'admin' performed an action on a remote host. They have the user's SID. Which filter would be most effective?

An analyst filters for network connections (event_simpleName=NetworkConnection) and sees a host making repeated connections to a known malicious IP address. What is the most important additional context to gather to confirm the host is compromised?

A threat hunter is looking for signs of credential dumping. They want to find events where the process 'lsass.exe' was accessed by another process. Which field and value combination should they filter on to identify these access events?

A threat hunter wants to find all events related to a specific file hash across the environment. They have the hash 'abc123def456'. Which filter should they use?

Keep studying — Event Search