A threat hunter is investigating a potential lateral movement attack. The hunter is using the 'Network Connections' Hunt report and needs to identify all connections from a compromised host (hostname 'SRV-001') to other internal hosts on port 445 (SMB). The report currently shows all network connections. The hunter wants to create a refined view that shows only these specific connections and also wants to see the process that initiated each connection. What is the most efficient approach?

Export the report to CSV and use a spreadsheet to filter the data for the hostname and port, then review the process name column.

Apply filters for 'Hostname' = 'SRV-001', 'Destination Port' = '445', and add the 'Process Name' column to the report view.

Apply a filter for 'Hostname' = 'SRV-001' and then click on each event to view the process name in the details pane.

Apply a filter for 'Destination Port' = '445' and then sort by 'Hostname' to manually identify the connections from SRV-001.

A threat hunter is examining a Hunt report for 'Ransomware Indicators'. The report shows a list of events, but the hunter wants to see a summary of the most common file names that were flagged. What feature of the Hunt report should the hunter use to get this aggregated view?

Use the 'Group By' option on the 'File Name' column to aggregate the events by that field.

Export the report and use a pivot table in a spreadsheet to count the file names.

Click on the 'File Name' column header to sort the data alphabetically.

Apply a filter on the 'File Name' column to show only the top 10 results.

CrowdStrikeCertified Falcon Hunter (CCFH)

Domain 5Objective 1

5.1 Use the Built-In Hunt Reports to Refine Event Details CCFH Practice Questions (Page 1)

Part of the Reports and References domain, which makes up ~8% of our current practice bank.

14questions here

3free pages

3concepts

Questions 1–5

1foundation · easy
An analyst is viewing a Hunt report and wants to see only events from a specific host. Which built-in option should they use?
Select an answer first
2expert · hard
A threat hunter is investigating a potential lateral movement attack. The hunter is using the 'Network Connections' Hunt report and needs to identify all connections from a compromised host (hostname 'SRV-001') to other internal hosts on port 445 (SMB). The report currently shows all network connections. The hunter wants to create a refined view that shows only these specific connections and also wants to see the process that initiated each connection. What is the most efficient approach?
Select an answer first
3application · medium
A threat hunter is examining a Hunt report for 'Ransomware Indicators'. The report shows a list of events, but the hunter wants to see a summary of the most common file names that were flagged. What feature of the Hunt report should the hunter use to get this aggregated view?
Select an answer first
4foundation · easy
A Hunt report shows a large number of events. The analyst wants to focus on events that occurred within the last 24 hours. Which built-in option should they use?
Select an answer first
5foundation · easy
A security analyst is in the Falcon console and needs to access the built-in Hunt reports. Which menu option should they select?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCFH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFH” is a trademark of its owner, used for identification only.

5.1 Use the Built-In Hunt Reports to Refine Event Details CCFH Practice Questions (Page 1)

Questions 1–5

An analyst is viewing a Hunt report and wants to see only events from a specific host. Which built-in option should they use?

A threat hunter is examining a Hunt report for 'Ransomware Indicators'. The report shows a list of events, but the hunter wants to see a summary of the most common file names that were flagged. What feature of the Hunt report should the hunter use to get this aggregated view?

A Hunt report shows a large number of events. The analyst wants to focus on events that occurred within the last 24 hours. Which built-in option should they use?

A security analyst is in the Falcon console and needs to access the built-in Hunt reports. Which menu option should they select?

Keep studying — Reports and References