Free CCFH-202 sample questions

Correct answer: Hash Search using the SHA256 hash captured from the original `ProcessRollup2` event.

Even if a file is deleted from the disk, CrowdStrike Falcon captures the hash of any process at the time of execution and records it within the `ProcessRollup2` event. A threat hunter can extract this SHA256 hash and use the global Hash Search feature to find every other instance where that exact binary was executed across the entire environment, regardless of its filename or if it was subsequently deleted.

Correct answer: `search` event_simpleName=DnsRequest | `rex` field=DomainName "(? [^.]+\.[^.]+)$" | `stats` dc(DomainName) as subdomain_count by aid, root_domain

This query correctly identifies DNS tunneling by first filtering for DNS request events. It then uses the `rex` command with a regular expression to extract the root domain (e.g., 'example.com' from 'a.b.c.example.com'). Finally, it uses `stats` to calculate the distinct count (`dc`) of unique full `DomainName` values, grouping them by the agent ID (`aid`) and the extracted `root_domain`. A high `subdomain_count` for a single `root_domain` on a specific host is a strong indicator of DNS tunneling.

Correct answer: Parent Process to `winword.exe` and Target Process to `powershell.exe`

In the Falcon event model, the 'Parent Process' is the process that created the event's target. The 'Target Process' is the process on which the action occurred. In the event where `cmd.exe` launches `powershell.exe`, `cmd.exe` is the Parent Process and `powershell.exe` is the Target Process. In the preceding event where `winword.exe` launched `cmd.exe`, `winword.exe` was the Parent Process.

Correct answers: `certutil.exe` making outbound network connections.; `certutil.exe` being executed with command-line arguments such as `-urlcache`, `-split`, and `-f`.

The `certutil.exe` binary is not expected to make network connections during its normal certificate management functions. An outbound network connection is highly anomalous and directly supports the hypothesis of it being used to download files.

These specific command-line arguments are used with `certutil.exe` to fetch a file from a URL and save it to the local disk. Their presence is a key indicator that the tool is being used for file download purposes, which is a common TTP for adversaries.

Correct answer: T1027: Obfuscated Files or Information

The `-e` or `-encodedcommand` parameter in PowerShell accepts a base64-encoded string. Adversaries use this to hide their commands from simple keyword-based detection and logging. This is a classic example of T1027: Obfuscated Files or Information, specifically sub-technique T1027.010 Command and Scripting Obfuscation.

Correct answer: False

The `stats` command is a powerful aggregation tool in CQL. In addition to `count`, it supports various other functions, including `avg()` for average, `sum()` for sum, `min()` for minimum, `max()` for maximum, `dc()` for distinct count, and `values()` to list distinct values.

Correct answer: Use Event Search with a CQL query for `event_simpleName=NetworkSend` where `ImageFileName=megasync.exe` and `UserName=j.doe`. Pipe the results to `| stats sum(bytes_sent) as TotalSent by ComputerName | table ComputerName, TotalSent`. Save this query to a new custom dashboard panel and visualize it as a bar chart.

This is the most direct and efficient method. The CQL query precisely targets the exfiltration activity by filtering for outbound network events (`NetworkSend`) from the specific application and user. Using `stats sum(bytes_sent) by ComputerName` aggregates the total data sent from each host, directly answering the core investigative question. Saving this to a custom dashboard provides a clear visualization (like a bar chart) that is perfect for management reporting and prioritizing the investigation on the hosts with the highest exfiltration volumes.

Correct answer: `event_simpleName=FileWritten` | `search` NOT `FileName IN ("*.log", "*.tmp")`

This query correctly uses the `search` command with the `NOT` operator to exclude results. The `IN` operator allows for checking against a list of values. By combining `NOT` and `IN`, the query efficiently filters out any `FileWritten` events where the `FileName` ends in either `.log` or `.tmp`. The wildcards `*` are also correctly used to match any filename.

Correct answer: Host Snapshot

The Host Snapshot feature provides a detailed point-in-time forensic capture of a host's state. This includes a list of running processes, active network connections, loaded drivers, and other critical system information. It is the designated tool for obtaining a comprehensive snapshot for deep analysis without needing a full Real Time Response session.

Correct answer: `event_simpleName=ProcessAccess TargetImageFileName=lsass.exe`

Credential dumping tools work by opening a handle to the `lsass.exe` process and reading its memory. The `ProcessAccess` event is specifically designed to capture this activity, logging when one process (`SourceImageFileName`) attempts to access another (`TargetImageFileName`). Searching for `ProcessAccess` events where `lsass.exe` is the target is the most direct way to identify the culprit process.