OpenExamsFREE PRACTICE — ANY EXAM

CrowdStrike Certified Falcon Hunter (CCFH) — Information & Free Practice

100 free questions · Answer explanations · No signup required

Start free practice →

Exam Review

About CrowdStrike Certified Falcon Hunter (CCFH)

CrowdStrike Certified Falcon Hunter (CCFH) · US

Key exam facts

Provider
Pearson
Format
Proctored, closed-book multiple-choice, single-correct response
Exam questions
Total questions: 60.
Time limit
90 minutes; approved language accommodation may allow 120 minutes
Exam fee
$250 USD; eligible Flex for Services named users receive included vouchers; additional Pearson taxes and fees may apply

Topics covered

  • MITRE ATT&CK® Frameworks

    • Cyber kill chain and intelligence gaps
    • Model threat actor behaviors with MITRE ATT&CK
    • Operationalize ATT&CK for threat research, pivots and communication

  • Detection Analysis

    • Analyze Host Timeline information
    • Analyze Process Timeline information
    • Pivot to additional investigative tools

  • Search and Investigation Tools

    • Analyze file and process metadata
    • Differentiate Investigate Module tools
    • Understand use cases for search options
    • Interpret search dashboards and determine further action

  • Event Search

    • Define CQL syntax
    • Build and execute CQL queries
    • Format event data for reading, export or charting
    • Filter events and analyze results
    • Describe Target, Parent and Context process relationships
    • Define key data event types
    • Convert Unix times to readable UTC
    • Create dashboards for Advanced Event Search results

  • Reports and References

    • Use built-in Hunt reports
    • Use built-in Visibility reports
    • Use Events Reference documentation

  • Hunting Analytics

    • Recognize suspicious and malicious behavior
    • Understand target assets and likely adversaries
    • Evaluate information reliability, validity and relevance
    • Consider alternative interpretations and reduce false positives
    • Decode PowerShell and CMD activity
    • Identify infection patterns and root cause
    • Distinguish legitimate activity from adversary behavior
    • Identify the exploited vulnerability from the initial vector

  • Hunting Methodology

    • Conduct routine active hunts for breaches
    • Perform outlier analysis
    • Generate and test hypotheses and hunting leads
    • Construct simple and complex EAM queries
    • Investigate a process tree

How to prepare

Work through the topics, read the explanation after each answer, and revisit the areas where you miss questions. Use the official outline and reference materials below to guide your study.

These independent practice questions are not actual exam items and do not guarantee a passing result.

Frequently asked questions

What is the exam format?

Proctored, closed-book multiple-choice, single-correct response

How many questions are on the exam?

Total questions: 60.

How long is the exam?

90 minutes; approved language accommodation may allow 120 minutes

How much does the exam cost?

$250 USD; eligible Flex for Services named users receive included vouchers; additional Pearson taxes and fees may apply

Official sources and references

Confirm current exam arrangements with the exam provider.