CrowdStrike CCFH: CrowdStrike Certified Falcon Hunter (CCFH)

Last checked November 10, 2026 against the official CrowdStrike exam page.

1. Question 1ATT&CK Frameworks

   A SOC lead asks a junior analyst to label a behavior where malware creates a scheduled task so it runs again after every reboot. Which ATT&CK element describes that specific method?

   1. AThe Persistence tactic
   2. BThe threat group profile entry
   3. CThe specific technique used
   4. DThe recommended mitigation guidance
   Show answer and explanationHide answer

   Correct answer: C

   Persistence is the tactic, meaning the adversary goal, while creating a scheduled task is a technique, meaning the specific method used. Group profiles describe actors and mitigations describe defensive controls, so neither names the method.

2. Question 2Detection Analysis

   An EDR alert fires on a finance workstation. The analyst needs every recorded event on that one machine, in time order, for the minutes before the alert. Which view should be used?

   1. AHost timeline for the affected workstation
   2. BHash search for the flagged file across the fleet
   3. CBulk domain search of the alert domains
   4. DUser search for the logged-in account
   Show answer and explanationHide answer

   Correct answer: A

   A host timeline lists every recorded event on one machine in time order, which matches the analyst's need. Hash search looks for a file across hosts, bulk domain search checks many domains, and user search focuses on one account rather than one machine.

3. Question 3Search and Investigation Tools

   An alert contains a SHA256 value for an executable. The analyst wants to see every host where that exact file has been observed. Which search fits best?

   1. AUser search for the account that opened the file
   2. BDomain search for the sites the file contacted
   3. CHash search for the SHA256 value
   4. DHost timeline of the first affected machine
   Show answer and explanationHide answer

   Correct answer: C

   Hash search matches one specific file by its SHA256 value across the environment. User search, domain search and a single-host timeline each answer a different question and would not reliably find every host holding that file.

4. Question 4Event Search

   An analyst wants to know how many distinct hosts ran a rarely seen executable during the past week, grouped by hostname. What is the most efficient approach?

   1. AOpen each host's timeline and count rows by hand
   2. BBuild a query for the executable and aggregate by host
   3. CRead the Events Data Dictionary for the executable count
   4. DExport raw events to a spreadsheet and sort by date
   Show answer and explanationHide answer

   Correct answer: B

   Building a query and aggregating results by host returns the distinct host count directly and can be repeated. Hand-counting timelines, sorting raw exports or reading a data dictionary does not give the grouped count efficiently.

5. Question 5Reports and References

   An analyst sees an unfamiliar field name in event results and does not know what the event type and its fields mean. Which reference should be consulted first?

   1. AThe sensor installation guide for the endpoint
   2. BThe Events Data Dictionary for event fields
   3. CThe ATT&CK technique list for tactics
   4. DThe Falcon billing and licensing report
   Show answer and explanationHide answer

   Correct answer: B

   The Events Data Dictionary documents event types and their fields, so it is the right reference when a field name is unclear. The installation guide, billing report and ATT&CK tactic list do not define Falcon event fields.