A security team has a list of 10,000 domains from a threat intelligence feed that are suspected of being used in a widespread phishing campaign. The team needs to identify any internal hosts that have communicated with these domains, but the team also wants to prioritize the investigation based on the most recent activity. Which search option should the team use?

Bulk domains search, then filter results by time

Hosts search for each internal host

Hash search for the phishing payload

IP address search for each domain's resolved IP

A security analyst is responding to a report that a specific server is behaving abnormally, possibly due to malware. The analyst wants to focus the investigation on that single machine to understand its recent activity. Which search option should the analyst use?

Hash search for suspicious files on the server

Users search for the server's service account

IP address search for the server's IP

A threat intelligence feed provides a list of 500 domains that are known to be used in a phishing campaign. The security team wants to check if any of these domains have been contacted by hosts in the environment. Which search option is most appropriate?

Hash search for the phishing payload

IP address search for each domain's resolved IP

CrowdStrikeCertified Falcon Hunter (CCFH)

Domain 3Objective 3

3.3 Understand Use Cases for Various Search Options (e.g., Users, Hosts, Hash Search, IP Addresses, and Bulk Domains) CCFH Practice Questions (Page 2)

Part of the Search and Investigation Tools domain, which makes up ~12% of our current practice bank.

15questions here

3free pages

6concepts

Questions 6–10

6expert · hard
A security team has a list of 10,000 domains from a threat intelligence feed that are suspected of being used in a widespread phishing campaign. The team needs to identify any internal hosts that have communicated with these domains, but the team also wants to prioritize the investigation based on the most recent activity. Which search option should the team use?
Select an answer first
7foundation · easy
A Falcon Hunter is investigating a potential lateral movement event. The team suspects that a specific user account was used to log into multiple hosts across the environment. Which search option would be most appropriate to start this investigation?
Select an answer first
8application · easy
A security analyst is responding to a report that a specific server is behaving abnormally, possibly due to malware. The analyst wants to focus the investigation on that single machine to understand its recent activity. Which search option should the analyst use?
Select an answer first
9application · medium
A threat intelligence feed provides a list of 500 domains that are known to be used in a phishing campaign. The security team wants to check if any of these domains have been contacted by hosts in the environment. Which search option is most appropriate?
Select an answer first
10foundation · easy
An analyst is investigating a potential data exfiltration incident. The analyst has a specific file hash from a malware sample and wants to see if that file was executed on any endpoints. Which search option should the analyst use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCFH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFH” is a trademark of its owner, used for identification only.

3.3 Understand Use Cases for Various Search Options (e.g., Users, Hosts, Hash Search, IP Addresses, and Bulk Domains) CCFH Practice Questions (Page 2)

Questions 6–10

A Falcon Hunter is investigating a potential lateral movement event. The team suspects that a specific user account was used to log into multiple hosts across the environment. Which search option would be most appropriate to start this investigation?

A security analyst is responding to a report that a specific server is behaving abnormally, possibly due to malware. The analyst wants to focus the investigation on that single machine to understand its recent activity. Which search option should the analyst use?

A threat intelligence feed provides a list of 500 domains that are known to be used in a phishing campaign. The security team wants to check if any of these domains have been contacted by hosts in the environment. Which search option is most appropriate?

An analyst is investigating a potential data exfiltration incident. The analyst has a specific file hash from a malware sample and wants to see if that file was executed on any endpoints. Which search option should the analyst use?

Keep studying — Search and Investigation Tools