A Falcon Hunter is preparing a report on authentication events. The raw data has a field `LogonType` with numeric codes (e.g., 2, 10, 11). The hunter wants the report to show the descriptive names (e.g., 'Interactive', 'RemoteInteractive', 'CachedInteractive') instead of the codes to make it more readable for the audience. Which technique should the hunter use?

Export the data to CSV and use a spreadsheet's find-and-replace feature.

Hide the `LogonType` field and add a note in the report explaining the codes.

Create an alias for the `LogonType` field to rename it to `LogonTypeDescription`.

Use a case or mapping function in the query to translate the numeric codes to their descriptive names.

A Falcon Hunter is analyzing network connection events and wants to identify if there is a relationship between the number of bytes sent and the number of bytes received for each connection. The hunter suspects a potential data exfiltration pattern where large outbound transfers correlate with small inbound responses. Which chart type would best reveal this correlation?

A bar chart with connection IDs on the x-axis and bytes on the y-axis.

A line chart with time on the x-axis and bytes on the y-axis.

A pie chart showing the proportion of total bytes sent vs. received.

A scatter plot with bytes sent on the x-axis and bytes received on the y-axis.

A Falcon hunter wants to reduce clutter in the Event Search results table by showing only the fields most relevant to the investigation. Which formatting technique directly supports this?

Selecting specific fields to display

CrowdStrikeCertified Falcon Hunter (CCFH)

Domain 4Objective 3

4.3 Format Event Data for User Readability, Export or Charting CCFH Practice Questions (Page 4)

Part of the Event Search domain, which makes up ~19% of our current practice bank.

18questions here

4free pages

3concepts

Questions 16–18

16application · medium
A Falcon Hunter is preparing a report on authentication events. The raw data has a field `LogonType` with numeric codes (e.g., 2, 10, 11). The hunter wants the report to show the descriptive names (e.g., 'Interactive', 'RemoteInteractive', 'CachedInteractive') instead of the codes to make it more readable for the audience. Which technique should the hunter use?
Select an answer first
17application · medium
A Falcon Hunter is analyzing network connection events and wants to identify if there is a relationship between the number of bytes sent and the number of bytes received for each connection. The hunter suspects a potential data exfiltration pattern where large outbound transfers correlate with small inbound responses. Which chart type would best reveal this correlation?
Select an answer first
18foundation · easy
A Falcon hunter wants to reduce clutter in the Event Search results table by showing only the fields most relevant to the investigation. Which formatting technique directly supports this?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CCFH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFH” is a trademark of its owner, used for identification only.

4.3 Format Event Data for User Readability, Export or Charting CCFH Practice Questions (Page 4)

Questions 16–18

A Falcon hunter wants to reduce clutter in the Event Search results table by showing only the fields most relevant to the investigation. Which formatting technique directly supports this?

Keep studying — Event Search