OpenExamsFREE PRACTICE — ANY EXAM

CrowdStrike Certified Falcon Hunter (CCFH) — Requirements & Free Practice

US · License preparation

100 free questions · Answer explanations · No signup required

Loading selected examination banks…

Choose what to practice

Start with an exam below. Your examination requirements depend on your application pathway. View licensing requirements

Licenses, application pathways and examination requirements

Each license and applicant pathway has its own requirements and exemptions. Choosing practice questions does not determine your eligibility.

CrowdStrike Certified Falcon Hunter (CCFH)

Role-based CrowdStrike certification for investigative analysts and Falcon threat hunters, awarded to individuals who pass the applicable examination; holders have a three-year certification term.

Licensing authority: CrowdStrike · Application information

Initial by examination
CrowdStrike Certified Falcon Hunter (CCFH)
Delivery
Proctored, closed-book English exam through Pearson OnVUE or a Pearson testing center. No separate practical/performance or writing examination is specified. Check OnVUE technical compatibility; accommodations must be requested before scheduling, including possible 120-minute language accommodation.
Eligibility
At least 18 years old; accept and comply with the CrowdStrike Certification Exam Agreement; pass the CCFH exam and refrain from misconduct.
Evidence Claim Ids
["ccfh-initial-route-exam","ccfh-current-registration","ccfh-current-assessment","ccfh-credential-authority"]
Holder Validity
Three years from successful examination; recertification requires the most current exam. This is individual award validity, not an examination retirement boundary.
Later Attempts
The CCFH guide says seven days after the second attempt for third and subsequent attempts. Beyond the fourth, approval is case-by-case; a fourth technical failure permits a fifth attempt. For a fourth personal-performance failure, wait 30 days, retake recommended training, receive CrowdStrike verification and meet its Certification Manager before fifth-registration clearance. Previously passed exams may be retaken only for approved recertification; beta exams cannot be retaken.
Registration
The guide requires purchasing an exam voucher to register. Current owner FAQ and Pearson instructions also permit credit-card payment during scheduling or voucher redemption, so a pre-purchased voucher is not the only documented payment workflow. Create/log in to a Pearson account; its name must match government-issued ID, which must be presented before testing.
Retake Policy
The July 2026 CCFH guide and current FAQ expressly require 48 hours after the first failure. The September 2026 general guide's CCFH paragraph instead says candidates should wait 24 hours. Preserve both wordings: the latter is a recommendation, not an express authorization to sit after 24 hours or a maximum wait; complying with the mandatory 48 hours also satisfies waiting at least 24 hours. This reconciliation follows their different modal language, not a claim that one source has been officially withdrawn or applies to a different population.
Training And Access
No initial training prerequisite and no required CSU account. Recommended: Falcon Hunter courses, specified Support Documentation, six months of Falcon production experience and sufficient English reading comprehension. Recommended CSU training requires an active organizational CrowdStrike subscription with Customer Center access; instructor-led courses may require training credits. CSU access facilitates learning and record tracking, not examination eligibility.

CrowdStrike Certified Falcon Hunter (CCFH)

Provider
Pearson
Format
Proctored, closed-book multiple-choice, single-correct response
Exam questions
Total questions: 60.
Time limit
90 minutes; approved language accommodation may allow 120 minutes
Exam fee
$250 USD; eligible Flex for Services named users receive included vouchers; additional Pearson taxes and fees may apply
Examination outline
  • MITRE ATT&CK® Frameworks
    • Cyber kill chain and intelligence gaps
    • Model threat actor behaviors with MITRE ATT&CK
    • Operationalize ATT&CK for threat research, pivots and communication
  • Detection Analysis
    • Analyze Host Timeline information
    • Analyze Process Timeline information
    • Pivot to additional investigative tools
  • Search and Investigation Tools
    • Analyze file and process metadata
    • Differentiate Investigate Module tools
    • Understand use cases for search options
    • Interpret search dashboards and determine further action
  • Event Search
    • Define CQL syntax
    • Build and execute CQL queries
    • Format event data for reading, export or charting
    • Filter events and analyze results
    • Describe Target, Parent and Context process relationships
    • Define key data event types
    • Convert Unix times to readable UTC
    • Create dashboards for Advanced Event Search results
  • Reports and References
    • Use built-in Hunt reports
    • Use built-in Visibility reports
    • Use Events Reference documentation
  • Hunting Analytics
    • Recognize suspicious and malicious behavior
    • Understand target assets and likely adversaries
    • Evaluate information reliability, validity and relevance
    • Consider alternative interpretations and reduce false positives
    • Decode PowerShell and CMD activity
    • Identify infection patterns and root cause
    • Distinguish legitimate activity from adversary behavior
    • Identify the exploited vulnerability from the initial vector
  • Hunting Methodology
    • Conduct routine active hunts for breaches
    • Perform outlier analysis
    • Generate and test hypotheses and hunting leads
    • Construct simple and complex EAM queries
    • Investigate a process tree
Examination sources