CrowdStrikeCertified Falcon Hunter (CCFH)
Domain 2Objective 3
2.3 Pivot from the Detection Page to Additional Investigative Tools CCFH Practice Questions (Page 2)
Part of the Detection Analysis domain, which makes up ~10% of our current practice bank.
10questions here
2free pages
3concepts
Questions 6–10
- 6
A detection page indicates that a host has been compromised by a known exploit that targets a specific vulnerability in a third-party application. The incident responder needs to identify all other hosts in the environment that are running the same vulnerable version of that application. Which pivot from the detection page would be the most effective starting point for this investigation?
Select an answer first - 7
An analyst is investigating a detection where a user clicked a malicious link in an email, which led to a browser download of a JavaScript file. The detection page shows the browser process and the downloaded file. The analyst wants to see the full network communication details, including the destination IP addresses and domains contacted by the browser during the infection. Which pivot from the detection page provides the most direct access to this network data?
Select an answer first - 8
A Falcon administrator is reviewing a detection for a suspicious PowerShell process that spawned from a Microsoft Word document. The detection page shows the command line and the parent-child process relationship. The administrator needs to determine if the same PowerShell command line has appeared on other hosts in the environment over the past 30 days. Which pivot action from the detection page is the most direct way to accomplish this?
Select an answer first - 9
An analyst is investigating a detection and needs to pivot to a tool that shows the vulnerability status of the affected host. Which pivot option from the detection page would provide this information?
Select an answer first - 10
An analyst pivots from a detection to Spotlight. How does the data from the detection page enhance the investigation in Spotlight?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
No more pagesBack to CCFH
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFH” is a trademark of its owner, used for identification only.