A Falcon administrator is investigating a credential theft incident where an attacker used a phishing email to trick a user into entering credentials on a fake login page. The administrator needs to identify the process that accessed the fake login page and the subsequent authentication attempt. Which event types should be combined in the search?

NetworkConnectIP4 and FileWritten

ProcessRollup2 and UserIdentityLogon

UserIdentityLogon and FileWritten

A Falcon administrator is investigating a multi-stage attack where the initial compromise was via a malicious document, followed by a PowerShell script that downloaded a payload, and finally the payload connected to a C2 server. The administrator needs to identify the process that downloaded the payload and the subsequent C2 connection. Which event types should be combined in the search?

ProcessRollup2 and NetworkConnectIP4

UserIdentityLogon and ProcessRollup2

NetworkConnectIP4 and FileWritten

CrowdStrikeCertified Falcon Responder (CCFR)

Domain 3Objective 3

Distinguish Between Commonly Used Event Types CCFR Practice Questions (Page 2)

Part of the Event Search domain, which makes up ~9% of our current practice bank.

19questions here

4free pages

3concepts

Questions 6–10

6application · medium
A security analyst is reviewing Falcon Event Search results to determine whether a user successfully authenticated to a domain controller. The analyst needs to identify the event type that captures successful and failed logon attempts. Which event type should be used?
Select an answer first
7expert · hard
A Falcon administrator is investigating a credential theft incident where an attacker used a phishing email to trick a user into entering credentials on a fake login page. The administrator needs to identify the process that accessed the fake login page and the subsequent authentication attempt. Which event types should be combined in the search?
Select an answer first
8expert · hard
A Falcon administrator is investigating a multi-stage attack where the initial compromise was via a malicious document, followed by a PowerShell script that downloaded a payload, and finally the payload connected to a C2 server. The administrator needs to identify the process that downloaded the payload and the subsequent C2 connection. Which event types should be combined in the search?
Select an answer first
9foundation · easy
Which Falcon Event Search event type is specifically used to record user authentication and logon activity?
Select an answer first
10application · medium
A threat hunter is investigating a potential malware infection where the malicious executable is suspected of modifying a system registry key to establish persistence. Which event type should the hunter query to identify the registry modification?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCFR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CrowdStrike. “CCFR” is a trademark of its owner, used for identification only.

Distinguish Between Commonly Used Event Types CCFR Practice Questions (Page 2)

Questions 6–10

A security analyst is reviewing Falcon Event Search results to determine whether a user successfully authenticated to a domain controller. The analyst needs to identify the event type that captures successful and failed logon attempts. Which event type should be used?

Which Falcon Event Search event type is specifically used to record user authentication and logon activity?

A threat hunter is investigating a potential malware infection where the malicious executable is suspected of modifying a system registry key to establish persistence. Which event type should the hunter query to identify the registry modification?

Keep studying — Event Search