Free CCFH practice test: 30 questions with answers

Persistence is the tactic, meaning the adversary goal, while creating a scheduled task is a technique, meaning the specific method used. Group profiles describe actors and mitigations describe defensive controls, so neither names the method.

Command and Control is the Kill Chain stage where an installed implant connects back to the attacker for instructions. Delivery moves the weapon to the target, Exploitation triggers the vulnerability, and Actions on Objectives is the final goal such as data theft.

Mapping hypotheses to technique IDs and using ATT&CK Navigator layers to show coverage both turn the framework into a working plan. Deleting techniques with no alerts creates blind spots, and tactics are broad goals rather than indicators of compromise.

ATT&CK tactics and techniques are fixed categories, so hunters map observed behavior onto existing techniques and the actor's group entry. Inventing new tactics, relying only on file hashes, or closing with a mitigation does not model how the actor behaves.

Weaponization pairs an exploit with a deliverable payload, here a backdoor inside a document, before anything reaches the target. Reconnaissance gathers target information, Installation happens after delivery and exploitation, and Delivery is the act of sending the weapon rather than building it.

A host timeline lists every recorded event on one machine in time order, which matches the analyst's need. Hash search looks for a file across hosts, bulk domain search checks many domains, and user search focuses on one account rather than one machine.

A process timeline is scoped to a single process and shows its activity in order. A host timeline would bring in the unrelated noise the analyst wants to avoid, and bulk domain or hash searches look across the fleet rather than one process's history.

Pivoting means using details from the detection, such as the process, host or hash, to open related searches and timelines for deeper investigation. Closing an alert because a name looks familiar, disabling telemetry or exporting without review all skip the investigation.

Searching the same process and command-line pattern across hosts shows how widespread the behavior is and is a quick, non-destructive first step. Restarting the host destroys volatile evidence, a blanket password reset is premature, and closing the alert without checking ignores the lead.

A narrow window around the detection time, reviewed on the host timeline, shows the surrounding activity on the affected machine. A full-year review, a fleet-wide name search or closing the case before investigating does not focus on what happened around the detection.

Hash search matches one specific file by its SHA256 value across the environment. User search, domain search and a single-host timeline each answer a different question and would not reliably find every host holding that file.

The file hash and its path, along with the parent process that launched it, are core file and process metadata used to identify and trace activity. Display resolution and browser theme say nothing about the file or how it ran.

User search gathers activity tied to one account, which is the clearest view of an account used across many hosts. IP search is scoped to an address, bulk domain search to sites and hash search to a file, so they are less direct for this question.

Bulk domain search is built to check many domains in one run, which suits a long list from a threat feed. Domain search handles one site at a time, while host search and hash search target an endpoint or a file.

Building a query and aggregating results by host returns the distinct host count directly and can be repeated. Hand-counting timelines, sorting raw exports or reading a data dictionary does not give the grouped count efficiently.

These relationships link the process that generated an event, the process or object it acted on, and the parent that launched it, which lets analysts reconstruct a chain of activity. Dashboard widgets, sensor ports and licensing are not part of these relationships.

Adding field filters and a narrower time range removes irrelevant events before review, which is the fastest way to reduce a large result set. Removing filters, adding widgets or reading line by line makes the problem worse or slower.

A Unix epoch value counts seconds since midnight UTC on January 1, 1970, so it can be converted to UTC and matched with other events. A day count, a time zone offset and a daily event count do not describe what the timestamp stores.

The Events Data Dictionary documents event types and their fields, so it is the right reference when a field name is unclear. The installation guide, billing report and ATT&CK tactic list do not define Falcon event fields.

A hunt report should record the hypothesis, queries, data sources, time range, findings and actions so others can reproduce and audit the work. A yes or no answer, a raw event dump or unrelated screenshots do not provide that.

If a host was not sending telemetry during the window, zero events reflects a visibility gap rather than clean activity. Patch level, asset name matching and subnet location do not show whether telemetry existed.

Confirming sensor reporting, checking whether the servers were offline or decommissioned, and verifying the search window overlaps the reporting period are all needed before a negative result is trusted. Treating missing events as proof of safety or assuming health from console reachability are unsupported conclusions.

Office spawning PowerShell with an encoded command shortly after an attachment is opened matches a well-known malicious pattern and needs investigation. The other options describe benign activity with no supporting evidence in the scenario.

PowerShell's encoded command option expects base64 of UTF-16LE text, so decoding with that encoding recovers the original script. Reading the string as ASCII, reversing it or converting hex would not produce the commands.

A known configuration tool on approved servers, plus a start time that matches an approved change schedule, points to expected automation. A new domain, an unsigned temp file and dropped binaries are typical of intrusion behavior.

A web worker process spawning a command shell right after requests to an unusual path suggests the application was exploited. Log rotation, a failed update and an antivirus update do not normally cause a web worker to start a shell.

Counting process names across the fleet and reviewing the rare ones is outlier analysis, which looks for activity that deviates from the common baseline. Routine hunts run on a schedule, hypothesis hunts start from a theory, and containment is a response step.

Hypothesis-driven hunting begins with a testable idea about adversary behavior and the data that would confirm or refute it. Running every query at once, waiting for an alert or patching everything does not start from a hypothesis.

Walking parent relationships upward reveals each launching step back to the origin of the activity. A name-only search loses the chain, restarting clears the running state, and child processes show only downstream effects.

Scheduling repeats and refreshing queries as techniques change keeps a routine hunt relevant, and grounding queries in documented intelligence keeps it targeted. Running once without revisiting, or skipping findings records, leaves the hunt stale and unauditable.