A detection page shows a malicious file with a specific SHA256 hash that was executed on a compromised host. The incident responder needs to determine if this file is present on any other hosts in the environment and whether those hosts have any known vulnerabilities that could be exploited. Which sequence of pivots from the detection page would be the most efficient to gather both pieces of information?

Pivot to IOA using the file hash, then pivot to Host Management using the host name

Pivot to Event Search using the file hash, then pivot to Spotlight using the same hash

Pivot to Spotlight using the file hash, then pivot to Event Search using the host ID

Pivot to Host Management using the file hash, then pivot to IOA using the host ID

After pivoting from a detection to Event Search, what data from the detection page is automatically carried over to inform the search?

The organization's global IOA rules

The detection's associated event data and context

While investigating a detection for a suspicious scheduled task creation, a Falcon analyst wants to review the raw event sequence that led to the detection, including all process creation events and network connections from the affected host in the minutes before the detection fired. Which pivot from the detection page provides the most comprehensive view of this raw event data?

Pivot to IOA using the detection ID

Pivot to Host Management using the agent ID

Pivot to Spotlight using the host name

Pivot to Event Search using the host ID as the filter

From the detection page, an analyst wants to navigate to a tool that displays behavioral indicators of attack (IOA) associated with the detection. Which navigation action should the analyst take?

Open the Spotlight module from the left navigation menu

Search for the detection ID in the Falcon console's global search

Use the 'Export' function to download the detection data

Click the 'View in IOA' link or button on the detection page

CrowdStrikeCertified Falcon Hunter (CCFH)

Domain 2Objective 3

2.3 Pivot from the Detection Page to Additional Investigative Tools CCFH Practice Questions (Page 1)

Part of the Detection Analysis domain, which makes up ~10% of our current practice bank.

10questions here

2free pages

3concepts

Questions 1–5

1application · medium
A detection page shows a malicious file with a specific SHA256 hash that was executed on a compromised host. The incident responder needs to determine if this file is present on any other hosts in the environment and whether those hosts have any known vulnerabilities that could be exploited. Which sequence of pivots from the detection page would be the most efficient to gather both pieces of information?
Select an answer first
2foundation · easy
After pivoting from a detection to Event Search, what data from the detection page is automatically carried over to inform the search?
Select an answer first
3application · medium
While investigating a detection for a suspicious scheduled task creation, a Falcon analyst wants to review the raw event sequence that led to the detection, including all process creation events and network connections from the affected host in the minutes before the detection fired. Which pivot from the detection page provides the most comprehensive view of this raw event data?
Select an answer first
4foundation · easy
From the detection page, an analyst wants to navigate to a tool that displays behavioral indicators of attack (IOA) associated with the detection. Which navigation action should the analyst take?
Select an answer first
5foundation · easy
While reviewing a detection in Falcon, a security analyst wants to open the raw event data associated with the detection in a new investigative view. Which pivot option is available directly from the detection page?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCFH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFH” is a trademark of its owner, used for identification only.

2.3 Pivot from the Detection Page to Additional Investigative Tools CCFH Practice Questions (Page 1)

Questions 1–5

After pivoting from a detection to Event Search, what data from the detection page is automatically carried over to inform the search?

From the detection page, an analyst wants to navigate to a tool that displays behavioral indicators of attack (IOA) associated with the detection. Which navigation action should the analyst take?

While reviewing a detection in Falcon, a security analyst wants to open the raw event data associated with the detection in a new investigative view. Which pivot option is available directly from the detection page?

Keep studying — Detection Analysis