A new analyst is learning how to use the Falcon console for hunting. The analyst has been told to review the 'Suspicious Processes' Hunt report but cannot find it in the list of reports. What is the most likely reason the analyst cannot see this report?

The report has been deleted by an administrator.

The analyst is not connected to the correct Falcon cloud environment.

The analyst does not have the 'Falcon Hunter' role assigned to their user account.

The analyst is looking in the 'Detections' menu instead of the 'Investigate' menu.

A Falcon administrator is investigating a series of suspicious registry modifications. The administrator is using the 'Registry Events' Hunt report and wants to focus on events where the registry key path contains 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run'. How can the administrator refine the report to show only these events?

Export the report to CSV and use a spreadsheet to filter the data for the registry path.

Use the 'Search' bar to type the registry path and filter the results.

Apply a text filter on the 'Registry Key Path' column for the specific path string.

Sort the report by the 'Registry Key Path' column and manually identify the relevant events.

CrowdStrikeCertified Falcon Hunter (CCFH)

Domain 5Objective 1

5.1 Use the Built-In Hunt Reports to Refine Event Details CCFH Practice Questions (Page 3)

Part of the Reports and References domain, which makes up ~8% of our current practice bank.

14questions here

3free pages

3concepts

Questions 11–14

11application · medium
A new analyst is learning how to use the Falcon console for hunting. The analyst has been told to review the 'Suspicious Processes' Hunt report but cannot find it in the list of reports. What is the most likely reason the analyst cannot see this report?
Select an answer first
12application · medium
A Falcon administrator is investigating a series of suspicious registry modifications. The administrator is using the 'Registry Events' Hunt report and wants to focus on events where the registry key path contains 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run'. How can the administrator refine the report to show only these events?
Select an answer first
13foundation · easy
In a Hunt report, which field is typically used to display the specific action or operation that was performed on a system?
Select an answer first
14foundation · easy
When viewing a Hunt report in the Falcon console, which section typically provides a summary of the report's purpose and the type of events it covers?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CCFH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFH” is a trademark of its owner, used for identification only.

5.1 Use the Built-In Hunt Reports to Refine Event Details CCFH Practice Questions (Page 3)

Questions 11–14

A new analyst is learning how to use the Falcon console for hunting. The analyst has been told to review the 'Suspicious Processes' Hunt report but cannot find it in the list of reports. What is the most likely reason the analyst cannot see this report?

In a Hunt report, which field is typically used to display the specific action or operation that was performed on a system?

When viewing a Hunt report in the Falcon console, which section typically provides a summary of the report's purpose and the type of events it covers?

Keep studying — Reports and References