CCFH-202試験無料問題集（62題）「CrowdStrike Certified Falcon Hunter 認定」

出題：1

Which threat framework allows a threat hunter to explore and model specific adversary tactics and techniques, with links to intelligence and case studies?

A. Director of National Intelligence Cyber Threat Framework

B. Lockheed Martin Cyber Kill Chain

C. NIST 800-171 Cyber Threat Framework

D. MITRE ATT&CK

正解：D 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：2

Which SPL (Splunk) field name can be used to automatically convert Unix times (Epoch) to UTC readable time within the Flacon Event Search?

A. time

B. _time

C. utc_time

D. conv_time

正解：B 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：3

An analyst has sorted all recent detections in the Falcon platform to identify the oldest in an effort to determine the possible first victim host What is this type of analysis called?

A. Visualization of hosts

B. Temporal analysis

C. Machine Learning

D. Statistical analysis

正解：B 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：4

Refer to Exhibit.

What type of attack would this process tree indicate?

A. Brute Forcing Attack

B. Phishing Attack

C. Web Application Attack

D. Man-in-the-middle Attack

正解：B 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：5

What information is provided from the MITRE ATT&CK framework in a detection's Execution Details?

A. Command Line

B. Triggering Indicator

C. Grouping Tag

D. Technique ID

正解：D 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：6

Refer to Exhibit.

Falcon detected the above file attempting to execute. At initial glance; what indicators can we use to provide an initial analysis of the file?

A. File path, hard disk volume number, and IOC Management action

B. File name, path, Local and Global prevalence within the environment

C. VirusTotal, Hybrid Analysis, and Google pivot indicator lights enabled

D. Local prevalence, IOC Management action, and Event Search

正解：B 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：7

Adversaries commonly execute discovery commands such as netexe, ipconfig.exe, and whoami exe. Rather than query for each of these commands individually, you would like to use a single query with all of them. What Splunk operator is needed to complete the following query?

A. AND

B. IN

C. NOT

D. OR

正解：D 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

CCFH-202試験無料問題集「CrowdStrike Certified Falcon Hunter 認定」