A security team has a known malicious file hash from a public threat report. They want to quickly determine if any endpoints in their environment have this file. Which search option is the most efficient?

Users search for the user who downloaded the file

IP address search for the file's download source

A Falcon administrator receives an alert about a suspicious login from a workstation. The investigation needs to determine whether the same user account has been used to log into other endpoints in the environment. Which search option should the administrator use first?

Hosts search for the workstation

IP address search for the workstation's IP

Hash search for the login binary

A security team is investigating a targeted attack where the attacker used a unique domain for C2 and a separate IP address for data exfiltration. The team has both indicators and wants to find any overlap between hosts that contacted the domain and hosts that contacted the IP. Which search option should the team use to identify the overlapping hosts?

Users search for the attacker's account

Bulk domains search for the domain, then IP address search for the IP, and compare results

CrowdStrikeCertified Falcon Hunter (CCFH)

Domain 3Objective 3

3.3 Understand Use Cases for Various Search Options (e.g., Users, Hosts, Hash Search, IP Addresses, and Bulk Domains) CCFH Practice Questions (Page 3)

Part of the Search and Investigation Tools domain, which makes up ~12% of our current practice bank.

15questions here

3free pages

6concepts

Questions 11–15

11application · easy
A security team has a known malicious file hash from a public threat report. They want to quickly determine if any endpoints in their environment have this file. Which search option is the most efficient?
Select an answer first
12application · medium
A Falcon administrator receives an alert about a suspicious login from a workstation. The investigation needs to determine whether the same user account has been used to log into other endpoints in the environment. Which search option should the administrator use first?
Select an answer first
13expert · hard
A security team is investigating a targeted attack where the attacker used a unique domain for C2 and a separate IP address for data exfiltration. The team has both indicators and wants to find any overlap between hosts that contacted the domain and hosts that contacted the IP. Which search option should the team use to identify the overlapping hosts?
Select an answer first
14foundation · easy
An analyst has identified a suspicious file hash from a threat intelligence feed and wants to determine if that file exists anywhere in the environment. Which search option should the analyst use?
Select an answer first
15foundation · easy
A security analyst is investigating a single endpoint that is exhibiting unusual behavior, such as repeated failed logins and unexpected process executions. The analyst wants to analyze the machine's activity in detail. Which search option is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CCFH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFH” is a trademark of its owner, used for identification only.

3.3 Understand Use Cases for Various Search Options (e.g., Users, Hosts, Hash Search, IP Addresses, and Bulk Domains) CCFH Practice Questions (Page 3)

Questions 11–15

A security team has a known malicious file hash from a public threat report. They want to quickly determine if any endpoints in their environment have this file. Which search option is the most efficient?

A Falcon administrator receives an alert about a suspicious login from a workstation. The investigation needs to determine whether the same user account has been used to log into other endpoints in the environment. Which search option should the administrator use first?

An analyst has identified a suspicious file hash from a threat intelligence feed and wants to determine if that file exists anywhere in the environment. Which search option should the analyst use?

A security analyst is investigating a single endpoint that is exhibiting unusual behavior, such as repeated failed logins and unexpected process executions. The analyst wants to analyze the machine's activity in detail. Which search option is most appropriate?

Keep studying — Search and Investigation Tools