A Falcon administrator is investigating a series of failed login attempts across the environment. The administrator is using the 'Authentication Events' Hunt report and wants to focus on events that occurred within the last hour. How can the administrator refine the report to show only these recent events?

Sort the report by the 'Timestamp' column in descending order to see the most recent events first.

Apply a filter on the 'Timestamp' column and enter a specific time value.

Use the 'Time Range' selector in the report's global filter bar and set it to 'Last 1 hour'.

Use the 'Search' bar to type 'last hour' and filter the results.

A threat hunter is analyzing a Hunt report titled 'Suspicious DNS Queries'. The report displays a table with columns for 'Timestamp', 'Hostname', 'Domain', and 'Query Type'. The hunter wants to understand the context of a specific DNS query, including which process initiated it and the associated network connection details. What should the hunter do to get this additional event detail from the report?

Apply a filter on the 'Domain' column to isolate the specific query and then review the remaining columns.

Use the 'Search' bar at the top of the report to query for the specific domain and its associated process.

Click on the specific event row to open the event details pane, which shows additional fields like 'Process Name' and 'Network Connection'.

Export the report to CSV and open it in a spreadsheet to see all hidden columns.

A threat hunter is reviewing the 'Executable Files Written' Hunt report. The hunter wants to understand the full context of a specific event, including the file hash, the process that wrote the file, and the parent process. What is the most efficient way to view all these details for a single event?

Click on the event row to open the event details pane, which contains all the associated fields for that event.

Apply a filter on the 'File Name' column to isolate the event and then review the remaining columns.

Export the report to CSV and open it in a spreadsheet to see all hidden columns.

Use the 'Search' bar to query for the file name and its associated process details.

A security analyst is responding to a potential malware outbreak and needs to review the built-in Hunt reports to understand the scope of the infection. The analyst has just logged into the Falcon console and wants to locate the Hunt reports. Where should the analyst navigate to find these reports?

Navigate to the 'Investigate' menu and select 'Hunt' to access the built-in Hunt reports.

Navigate to the 'Detections' menu and select 'Hunt' to access the reports.

Navigate to the 'Endpoints' menu and select 'Reports' to access the Hunt reports.

Navigate to the 'Dashboard' menu and select 'Hunt Reports' from the left-hand sidebar.

A Falcon administrator wants to open the built-in Hunt reports in the Falcon console. Which navigation path correctly locates these reports?

Investigate → Event Search → Saved Searches

Investigate → Hunt → Reports

Investigate → Detections → Reports

Investigate → Hosts → Reports

CrowdStrikeCertified Falcon Hunter (CCFH)

Domain 5Objective 1

5.1 Use the Built-In Hunt Reports to Refine Event Details CCFH Practice Questions (Page 2)

Part of the Reports and References domain, which makes up ~8% of our current practice bank.

14questions here

3free pages

3concepts

Questions 6–10

6application · easy
A Falcon administrator is investigating a series of failed login attempts across the environment. The administrator is using the 'Authentication Events' Hunt report and wants to focus on events that occurred within the last hour. How can the administrator refine the report to show only these recent events?
Select an answer first
7application · medium
A threat hunter is analyzing a Hunt report titled 'Suspicious DNS Queries'. The report displays a table with columns for 'Timestamp', 'Hostname', 'Domain', and 'Query Type'. The hunter wants to understand the context of a specific DNS query, including which process initiated it and the associated network connection details. What should the hunter do to get this additional event detail from the report?
Select an answer first
8application · medium
A threat hunter is reviewing the 'Executable Files Written' Hunt report. The hunter wants to understand the full context of a specific event, including the file hash, the process that wrote the file, and the parent process. What is the most efficient way to view all these details for a single event?
Select an answer first
9application · easy
A security analyst is responding to a potential malware outbreak and needs to review the built-in Hunt reports to understand the scope of the infection. The analyst has just logged into the Falcon console and wants to locate the Hunt reports. Where should the analyst navigate to find these reports?
Select an answer first
10foundation · easy
A Falcon administrator wants to open the built-in Hunt reports in the Falcon console. Which navigation path correctly locates these reports?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCFH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFH” is a trademark of its owner, used for identification only.

5.1 Use the Built-In Hunt Reports to Refine Event Details CCFH Practice Questions (Page 2)

Questions 6–10

A security analyst is responding to a potential malware outbreak and needs to review the built-in Hunt reports to understand the scope of the infection. The analyst has just logged into the Falcon console and wants to locate the Hunt reports. Where should the analyst navigate to find these reports?

A Falcon administrator wants to open the built-in Hunt reports in the Falcon console. Which navigation path correctly locates these reports?

Keep studying — Reports and References