View Full CrowdStrike CCFH-202b Exam Dumps and Practice Test Dumps

 

Question 61.

A Falcon Hunter observes that a suspicious process executed on several hosts within a short time window. What is the best next step?

1. Compare the affected hosts, users, parent processes, command lines, and network activity to identify a common source
   2. Assume the activity is legitimate because it is widespread
   3. Delete all related detections
   4. Investigate only the first host

Correct Answer: 1

Explanation:

When suspicious activity appears across multiple hosts, the hunter should determine what those systems have in common. Shared users, parent processes, deployment tools, domains, or timestamps may reveal a common infection source or attacker action. Cross-host comparison helps establish scope and identify the mechanism used to spread the activity. Widespread behavior should not automatically be considered benign, especially when the timing and process characteristics are unusual.

Question 62.

Which activity most strongly suggests a persistence technique on Windows endpoints?

1. A browser opens a normal website
   2. A user saves a document
   3. A scheduled inventory process runs
   4. An unfamiliar executable is added to an autorun location and launches after login

Correct Answer: 4

Explanation:

Autorun locations are commonly used to start programs automatically when a system boots or a user logs in. An unfamiliar executable appearing in such a location can indicate persistence, especially when combined with unusual parent processes, paths, or user activity. The hunter should inspect who created the entry, when it was created, the referenced executable, and whether the same mechanism exists elsewhere in the environment.

Question 63.

A hunter wants to determine whether suspicious remote authentication activity represents lateral movement. Which combination of evidence is most useful?

1. Printer configuration and screen settings
   2. Browser bookmarks only
   3. Source host, destination host, account used, authentication time, and resulting process activity
   4. File compression ratio

Correct Answer: 3

Explanation:

Lateral movement investigations require context about where the connection originated, which account authenticated, which destination system was reached, and what happened afterward. Resulting process activity can show whether the authentication led to remote command execution or other suspicious actions. This evidence helps distinguish normal administrative behavior from attacker movement. Authentication events alone may not be sufficient without related endpoint context.

Question 64.

Which approach is most appropriate when hunting for suspicious use of built-in system utilities?

1. Treat every built-in utility as malicious
   2. Evaluate command line, parent process, user, execution path, and subsequent behavior
   3. Ignore all signed binaries
   4. Search only for malware filenames

Correct Answer: 2

Explanation:

Attackers often use trusted system utilities to perform malicious actions without introducing obvious malware. Hunters should therefore focus on how a tool is being used rather than whether it is legitimate software. Unusual command-line arguments, unexpected parents, uncommon users, strange execution paths, or suspicious follow-on activity can indicate abuse. Signed binaries can still be used maliciously.

Question 65.

A Falcon Hunter finds an executable that appears only once across the entire environment. What should the hunter do?

1. Investigate its path, hash, parent process, command line, user context, and related activity
   2. Assume it is malicious solely because it is rare
   3. Ignore it because only one host is affected
   4. Delete all rare-process events

Correct Answer: 1

Explanation:

Rarity is a useful hunting signal but not proof of maliciousness. A process that appears only once may be a legitimate custom application or an attacker tool. The hunter should analyze surrounding context such as execution path, hash, parent process, command line, user, network activity, and file operations. Combining rarity with suspicious behavior produces a stronger hunting lead than frequency alone.

Question 66.

Which behavior most strongly indicates possible command-and-control beaconing?

1. A user opens a local application
   2. A routine system update occurs
   3. A printer service restarts
   4. A process makes repeated outbound connections to the same rare destination at regular intervals

Correct Answer: 4

Explanation:

Periodic outbound connections to a rare destination can indicate beaconing behavior used by command-and-control frameworks. The hunter should examine connection intervals, destination reputation, the initiating process, affected hosts, and whether the traffic coincides with other suspicious activity. Legitimate software can also communicate periodically, so the behavior should be compared with known baselines before concluding it is malicious.

Question 67.

Which event pattern is most useful when hunting for possible credential dumping?

1. Normal application startup
   2. Routine software installation
   3. An unusual process accessing credential-related memory or security processes
   4. A user printing a document

Correct Answer: 3

Explanation:

Credential dumping often involves processes attempting to access sensitive authentication memory or credential stores. The hunter should identify the responsible process, user privileges, parent process, command line, and subsequent authentication behavior. If unusual remote logins or privilege escalation follow, that can strengthen the hypothesis that credentials were stolen and used. Legitimate administrative software should still be evaluated in context.

Question 68.

Which statement best describes the value of grouping search results by host or user during an investigation?

1. It removes all useful detail
   2. It helps reveal concentration, spread, and unusual patterns in large data sets
   3. It guarantees the activity is malicious
   4. It eliminates the need for raw-event review

Correct Answer: 2

Explanation:

Grouping by host, user, process, or destination can show where activity is concentrated and reveal outliers that deserve closer attention. For example, a suspicious command may appear on one host or across dozens of systems. Aggregation helps prioritize investigation but does not replace reviewing individual events. Hunters should use summarized results to identify meaningful patterns and then drill into the underlying telemetry.

Question 69.

A hunter observes a script interpreter launching from a document application. What should be investigated first?

1. The parent-child relationship, command line, document origin, and resulting activity
   2. The user’s desktop wallpaper
   3. Printer history
   4. Screen resolution

Correct Answer: 1

Explanation:

A document application launching a script interpreter can indicate malicious document execution, exploitation, or user-enabled macros. The hunter should inspect the document source, process tree, command-line arguments, child processes, file activity, and network connections. This relationship can also occur legitimately in specialized workflows, so context is essential. The execution chain is often more informative than the individual process names.

Question 70.

Which behavior is most suspicious during a hunt for data staging?

1. A user opens a browser
   2. A system performs a routine backup
   3. A standard software update downloads
   4. A process collects files from multiple directories and creates a large archive in a temporary location

Correct Answer: 4

Explanation:

Attackers may gather and compress data before exfiltration. A process collecting many files from different directories and placing them into a large archive can indicate staging activity, especially if followed by unusual outbound communication. The hunter should inspect file sources, archive path, responsible process, user context, and subsequent network events. Legitimate backup or administrative tools may behave similarly, so validation is necessary.

Question 71.

Which hunting technique is most useful when adversaries continuously change file hashes but repeat the same execution sequence?

1. Search only exact hashes
   2. Search only filenames
   3. Behavioral hunting based on process ancestry, commands, and event sequences
   4. Ignore process telemetry

Correct Answer: 3

Explanation:

Attackers can easily alter files and produce different hashes, but they may still follow recognizable behavioral patterns. Hunting for process ancestry, command-line syntax, persistence methods, and event sequences provides more durable detection than static indicators alone. Hashes and filenames remain useful pivots, but behavioral hunting is better suited to identifying modified tools that perform the same actions.

Question 72.

Which statement best describes why baselining is valuable during threat hunting?

1. It automatically blocks unusual activity
   2. It establishes expected behavior so deviations can be identified and investigated
   3. It proves that all common behavior is safe
   4. It removes the need for hypothesis-driven hunting

Correct Answer: 2

Explanation:

A baseline gives hunters a reference for what normal activity looks like for a host, user, process, or environment. Unusual behavior can then be prioritized for deeper review. Common activity is not always benign, and rare activity is not always malicious, so baselines must be combined with context. They are especially useful when hunting for account compromise, abnormal process execution, or unusual network behavior.

Question 73.

A suspicious account authenticates to multiple endpoints within a few minutes. What should a Falcon Hunter investigate next?

1. The source systems, destination hosts, authentication method, and subsequent process activity
   2. Only the account’s display name
   3. Printer status
   4. Desktop background settings

Correct Answer: 1

Explanation:

Rapid authentication across multiple endpoints can indicate automated administration, legitimate support work, or lateral movement. The hunter should determine where the activity originated, which systems were accessed, how authentication occurred, and what actions followed. Process execution on destination systems can provide evidence of remote command execution. Time correlation and user role context are important for distinguishing legitimate from malicious behavior.

Question 74.

Which activity most strongly suggests an attempt to evade endpoint security?

1. A browser updates normally
   2. A user logs on successfully
   3. A scheduled scan completes
   4. A process stops security services, modifies exclusions, and then launches an unknown binary

Correct Answer: 4

Explanation:

Stopping security services and modifying exclusions immediately before launching an unknown binary strongly suggests defense evasion. The hunter should identify the responsible process, user, parent process, command line, and any subsequent payload execution or network activity. Combining multiple security-control modifications provides stronger evidence than a single isolated event and should receive high investigative priority.

Question 75.

Which approach is most effective when investigating a suspicious domain found in one detection?

1. Review only the domain reputation
   2. Ignore the endpoint that contacted it
   3. Search enterprise telemetry for hosts, processes, users, and timestamps associated with the domain
   4. Delete the original detection

Correct Answer: 3

Explanation:

Searching across enterprise telemetry helps establish whether the domain is associated with one system or multiple hosts. The hunter can identify initiating processes, users, connection timing, DNS lookups, and related activity. Reputation information may be helpful, but local telemetry is necessary to understand how the domain was used. A suspicious domain should be treated as an investigation pivot rather than the final conclusion.

Question 76.

Which statement best describes the role of hypothesis refinement during a threat hunt?

1. The original hypothesis must never change
   2. Hunters update the hypothesis as new evidence reveals more accurate or useful questions
   3. Refinement means deleting all prior results
   4. A hunt is unsuccessful if the original hypothesis is rejected

Correct Answer: 2

Explanation:

Threat hunting is iterative. Initial searches may uncover evidence that changes the hunter’s understanding of the activity. The hypothesis can then be refined to focus on more specific behaviors, hosts, users, or techniques. Rejecting an initial hypothesis can still be valuable because it improves understanding of the environment and may reveal telemetry gaps. The objective is evidence-driven investigation rather than proving the original assumption correct.

Question 77.

A hunter discovers a suspicious executable on one host and wants to determine whether it is part of a larger campaign. Which action is best?

1. Pivot on the hash, path, command line, network indicators, and behavior across enterprise telemetry
   2. Investigate only the original hostname
   3. Ignore related network activity
   4. Delete the file before collecting context

Correct Answer: 1

Explanation:

Multiple pivots can reveal whether the activity extends beyond the original endpoint. Searching hashes, paths, command lines, domains, IP addresses, users, and behavioral patterns may identify other affected systems. Attackers can change individual indicators, so combining static and behavioral pivots is more effective than relying on one artifact. Enterprise-wide scoping is essential before concluding that an incident is isolated.

Question 78.

Which behavior is most suspicious during a hunt for possible privilege escalation?

1. A user opens a normal application
   2. A scheduled system task executes normally
   3. An approved update installs
   4. A low-privilege process unexpectedly launches a child process with elevated rights

Correct Answer: 4

Explanation:

An unexpected transition from low privilege to elevated execution can indicate privilege escalation, exploitation, or misuse of a privileged helper. The hunter should examine the parent process, account, command line, elevation mechanism, and subsequent activity. Legitimate installers and administrative workflows can also elevate processes, so the event should be compared with expected behavior and software context.

Question 79.

Which investigation method is most useful for understanding what occurred immediately before and after a suspicious detection?

1. Reviewing only the detection title
   2. Searching only the file hash
   3. Constructing a host or process timeline from related events
   4. Reviewing only the user’s department

Correct Answer: 3

Explanation:

A timeline helps reconstruct the sequence of events surrounding suspicious activity. It can show process launches, file creation, network connections, authentication, persistence changes, and other events before and after a detection. Sequence and timing often reveal relationships that individual events do not. Timelining is especially useful when trying to determine the initial execution path and subsequent attacker actions.

Question 80.

Which action best completes a threat-hunting investigation after the hunter confirms malicious activity?

1. Delete all hunting results
   2. Document the findings, determine scope, support containment or remediation, and improve future detection logic
   3. Stop collecting relevant telemetry
   4. Leave the activity undocumented

Correct Answer: 2

Explanation:

A completed hunt should improve both immediate response and future defense. Findings should be documented with affected hosts, users, timelines, behaviors, and relevant indicators. Confirmed malicious activity should be shared with response teams for containment and remediation. Valuable hunting logic can also be converted into reusable detections or future hunt queries. This feedback loop helps the security program become more effective over time.