CrowdStrike Exam CCFH-202 Topic 2 Question 9 Discussion

Actual exam question for CrowdStrike's CCFH-202 exam

Question #: 9
Topic #: 2

Which of the following is an example of a Falcon threat hunting lead?

AA routine threat hunt query showing process executions of single letter filename (e.g., a.exe) from temporary directories

BSecurity appliance logs showing potentially bad traffic to an unknown external IP address

CA help desk ticket for a user clicking on a link in an email causing their machine to become unresponsive and have high CPU usage

DAn external report describing a unique 5 character file extension for ransomware encrypted files

Show Suggested Answer

Suggested Answer: A

The Agent ID (AID) and the Target Process ID are the elements that are required to properly execute a Process Timeline. The Agent ID (AID) is a unique identifier for each host that has a Falcon sensor installed. The Target Process ID is the decimal representation of the process identifier for the process that you want to investigate. These two elements are used to query the cloud for the events related to the process on the host. The Agent ID (AID) only, the Hostname and Local Process ID, and the Target Process ID only are not sufficient to execute a Process Timeline.

by Lindsey at Aug 08, 2023, 01:23 PM

Limited Time Offer

25%

Off

Get Premium CCFH-202 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Annmarie

1 months ago

D, no doubt. Anything with the word 'ransomware' is a surefire winner. Although, I do wonder if the answer is hidden in the file extension, like 'R4ns0mw4r3.exe'.

upvoted 0 times

...

1 months ago

B sounds promising, but I'm going to go with D. That unique file extension is a dead giveaway for ransomware, and it's an external report, so it's gotta be legit, right?

upvoted 0 times

Yesenia

17 days ago

I agree with you, D seems like the most reliable lead. We should definitely investigate further based on that external report.

upvoted 0 times

...

Lashawna

29 days ago

I see your point, but I still think D is the best option. That unique file extension for ransomware is a clear indicator of a threat.

upvoted 0 times

...

Edison

1 months ago

I think B is a good choice too, but I'm leaning towards A. Process executions of single letter filenames from temporary directories sounds suspicious.

upvoted 0 times

...

Wenona

2 months ago

I'm not sure, but I think B) Security appliance logs showing potentially bad traffic to an unknown external IP address could also be a valid option.

upvoted 0 times

...

2 months ago

I think the answer is A) A routine threat hunt query showing process executions of single letter filename (e.g., a.exe) from temporary directories.

upvoted 0 times

...