Question 1

With Custom Alerts you are able to configure email alerts using predefined templates so you're notified about specific activity in your environment. Which of the following outlines the steps required to properly create a custom alert rule?

Options :

A : Choose the template you would like to configure, setup how often you would like the alert to run, and then schedule the alert

B : Choose the template you would like to configure, preview the search results, and then schedule the alert

C : Create the query for the alert, setup the email template for the alert, and then set the schedule for the alert

D : Create a new custom template, configure the email template, and then create the custom query for the alert

Answer: B

Question 2

Which threat framework allows a threat hunter to explore and model specific adversary tactics and techniques, with links to intelligence and case studies?

Options :

A : MITRE ATT&CK

B : Lockheed Martin Cyber Kill Chain

C : Director of National Intelligence Cyber Threat Framework

D : NIST 800-171 Cyber Threat Framework

Answer: A

Question 3

You need details about key data fields and sensor events which you may expect to find fromHosts running the Falcon sensor.Which documentation should you access?

Options :

A : Events Data Dictionary

B : Streaming API Event Dictionary

C : Hunting and Investigation

D : Event stream APIs

Answer: A

Question 4

To find events that are outliers inside a network,___________is the best hunting method to use.

Options :

A : time-based

B : machine learning

C : searching

D : stacking

Answer: D

Question 5

How do you rename fields while using transforming commands such as table, chart, and stats?

Options :

A : By renaming the fields with the "rename" command after the transforming command e.g. "stats count by ComputerName | rename count AS total_count"

B : You cannot rename fields as it would affect sub-queries and statistical analysis

C : By using the "renam

D : By specifying the desired name after the field name eg "stats count totalcount by ComputerName"

Answer: A

Free CCFH-202b Mock Exam – Practice Online Confidently

Buying Options: