Free CrowdStrike CCFH-202 Exam Dumps Questions & Answers

SPL (Splunk) eval statements can be used to convert Unix times (Epoch) into UTC readable time Which eval function is correct^

• A.  relative time
• B.  typeof
• C.  now
• D.  strftime

What Investigate tool would you use to allow an analyst to view all events for a specific host?

• A.  Host Timeline
• B.  Bulk Timeline
• C.  Process Timeline
• D.  Host Search

Which of the following is a recommended technique to find unique outliers among a set of data in the Falcon Event Search?

• A.  Stacking (Frequency Analysis)
• B.  Time-based Searching
• C.  Machine Learning
• D.  Hunt-and-Peck Search Methodology

What do you click to jump to a Process Timeline from many pages in Falcon, such as a Hash Search?

• A.  CID
• B.  Process ID or Parent Process ID
• C.  PID
• D.  Process Timeline Link

How do you rename fields while using transforming commands such as table, chart, and stats?

• A.  By specifying the desired name after the field name eg "stats count totalcount by ComputerName"
• B.  By renaming the fields with the "rename" command after the transforming command e.g. "stats count by ComputerName | rename count AS total_count"
• C.  By using the "renamed" keyword after the field name eg "stats count renamed totalcount by ComputerName"
• D.  You cannot rename fields as it would affect sub-queries and statistical analysis