A Falcon hunter is using a bar chart to visualize the number of failed login attempts per user over the last week. Most users have 0–5 failures, but one user has 150 failures. The hunter wants to investigate this outlier. Which action would be most effective?

Change the chart to a line graph to see the trend over time.

Export the chart to a CSV file for further analysis in a spreadsheet.

Filter the chart to exclude users with fewer than 10 failed logins.

Click on the bar representing the user with 150 failures to see the individual failed login events.

A Falcon hunter is reviewing a server that runs a critical database. The server's baseline shows a consistent pattern of 100–200 database queries per minute. Over the last 30 minutes, the query rate has dropped to 10–20 per minute. The hunter suspects a denial-of-service condition or a failing application. Which approach best balances the need to investigate the outlier with the need to maintain business continuity?

Investigate the process tree and recent application logs to determine if the drop is due to a failed component or a legitimate maintenance window.

Immediately restart the database service to restore normal query rates.

Block all inbound connections to the database server to prevent further issues.

Compare the query rate to the company-wide average to confirm the outlier.

A Falcon hunter is investigating an outlier event where a host made a single large outbound file transfer at 3 AM. The host's baseline shows no previous large transfers. The hunter has identified the process as `svchost.exe`. What is the most appropriate next step?

Examine the process tree to see the parent process of the `svchost.exe` instance and check for any injected or suspicious modules.

Search for other hosts that have made large transfers at 3 AM to see if it is a pattern.

Block all outbound traffic from the host to prevent further transfers.

Conclude the activity is benign because `svchost.exe` is a legitimate Windows process.

Which Falcon visualization is most useful for understanding the context of an outlier event, such as the sequence of processes that led to it?

Line graph of network traffic volume

CrowdStrikeCertified Falcon Hunter (CCFH)

Domain 7Objective 2

7.2 Perform Outlier Analysis with the Falcon Tool CCFH Practice Questions (Page 5)

Part of the Hunting Methodology domain, which makes up ~17% of our current practice bank.

25questions here

5free pages

7concepts

Questions 21–25

21application · medium
A Falcon hunter is using a bar chart to visualize the number of failed login attempts per user over the last week. Most users have 0–5 failures, but one user has 150 failures. The hunter wants to investigate this outlier. Which action would be most effective?
Select an answer first
22expert · hard
A Falcon hunter is reviewing a server that runs a critical database. The server's baseline shows a consistent pattern of 100–200 database queries per minute. Over the last 30 minutes, the query rate has dropped to 10–20 per minute. The hunter suspects a denial-of-service condition or a failing application. Which approach best balances the need to investigate the outlier with the need to maintain business continuity?
Select an answer first
23application · medium
A Falcon hunter is investigating an outlier event where a host made a single large outbound file transfer at 3 AM. The host's baseline shows no previous large transfers. The hunter has identified the process as `svchost.exe`. What is the most appropriate next step?
Select an answer first
24foundation · easy
Which Falcon visualization is most useful for understanding the context of an outlier event, such as the sequence of processes that led to it?
Select an answer first
25foundation · easy
Which Falcon feature enables a hunter to narrow down search results to only events that occurred outside of business hours?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CCFH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFH” is a trademark of its owner, used for identification only.

7.2 Perform Outlier Analysis with the Falcon Tool CCFH Practice Questions (Page 5)

Questions 21–25

A Falcon hunter is using a bar chart to visualize the number of failed login attempts per user over the last week. Most users have 0–5 failures, but one user has 150 failures. The hunter wants to investigate this outlier. Which action would be most effective?

A Falcon hunter is investigating an outlier event where a host made a single large outbound file transfer at 3 AM. The host's baseline shows no previous large transfers. The hunter has identified the process as `svchost.exe`. What is the most appropriate next step?

Which Falcon visualization is most useful for understanding the context of an outlier event, such as the sequence of processes that led to it?

Which Falcon feature enables a hunter to narrow down search results to only events that occurred outside of business hours?

Keep studying — Hunting Methodology