Free CrowdStrike Certified Falcon Hunter (CCFH) Practice Questions

Sample Practice Questions

Try these 10 sample questions from the CrowdStrike Certified Falcon Hunter (CCFH) practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1In the cyber kill chain, which phase involves gathering details about a target and its weaknesses before launching an attack?

   1. A.ReconnaissanceCorrect answer: A
   2. B.Weaponization
   3. C.Delivery
   4. D.Installation

   Explanation: CrowdStrike says, "During the Reconnaissance phase, a malicious actor identifies a target and explores vulnerabilities and weaknesses that can be exploited within the network." That is the gathering activity described; weaponization creates an attack vector, delivery launches it, and installation places it on the victim system.

   Reference: What Is the Cyber Kill Chain? — 8 Phases of the Cyber Kill Chain Process, Phase 1: Reconnaissance

2. 2An analyst begins with a Falcon detection and wants to examine the flow of events associated with its process. Which investigative view can the analyst pivot to?

   1. A.Host Search
   2. B.User Search
   3. C.Process TimelineCorrect answer: C
   4. D.Bulk Domain Search

   Explanation: CrowdStrike's responder syllabus includes the workflow "Pivot from a detection to a process timeline". That view addresses the process-event sequence; the other choices search different objects.

   Reference: FHT 201 Falcon Platform for Responders Course Syllabus — Process and Host Timelines

3. 3An analyst searches Falcon Investigate using the SHA-256 of a suspicious file. What is the search intended to locate?

   1. A.Instances of the file associated with that hashCorrect answer: A
   2. B.Every file sharing its name, regardless of content
   3. C.Every file in its directory, regardless of content
   4. D.Every executable with the same file extension

   Explanation: CrowdStrike recommends "identify a risky file’s hash and then search for instances of that in your environment." The hash-based search targets instances of that file, not every file sharing a name, directory, or extension.

   Reference: How to Perform a Simple File Search with the Falcon Investigate App — Introduction

4. 4In a CQL filter expression without parentheses, which logical operator binds more tightly?

   1. A.AND binds more tightly than OR
   2. B.OR binds more tightly than ANDCorrect answer: B
   3. C.AND and OR have equal precedence
   4. D.Precedence follows left-to-right order

   Explanation: The CQL operator reference states, "In CQL, OR binds closer than AND, which is different from most programming languages." Thus OR is evaluated as the more tightly bound operator; parentheses can make grouping explicit.

   Reference: Operators | CrowdStrike Query Language — Logical Operators

5. 5A hunter needs the vendor's reference for understanding event types contained in Falcon Data Replicator data. Which document does CrowdStrike direct the analyst to consult?

   1. A.Events Data DictionaryCorrect answer: A
   2. B.Falcon Data Replicator Guide
   3. C.Falcon Management Guide
   4. D.Hunting Guides

   Explanation: The FDR guide directs readers, "For information about the event types contained in FDR, please refer to the Events Data Dictionary documentation". That is the reference designated for the event types.

   Reference: CrowdStrike Falcon Data Replicator Technical Add-On Guide — Introduction, page 3

6. 6While hunting possible WMI remote execution, which observed process relationship warrants investigation as a potential indicator?

   1. A.WMIPRVSE.EXE spawning CMD.EXECorrect answer: A
   2. B.CMD.EXE spawning WMIPRVSE.EXE
   3. C.POWERSHELL.EXE spawning WMIPRVSE.EXE
   4. D.A browser process spawning CMD.EXE

   Explanation: CrowdStrike describes "CMD.EXE or POWERSHELL.EXE running as a child process to WMIPRVSE.EXE" as a red flag for the hunt. This is an indicator to investigate in context, not proof that every such process is malicious.

   Reference: How to Detect and Prevent Impacket's Wmiexec — Initial Indicators

7. 7A hunter finds a low-fidelity lead during a proactive Falcon investigation. What should happen before treating the lead as a confirmed detection?

   1. A.Correlate it with other evidence and add contextCorrect answer: A
   2. B.Treat the lead itself as a confirmed alert
   3. C.Discard it because it is not already a detection
   4. D.Assume all related events are malicious

   Explanation: CrowdStrike says hunting leads "must be correlated and contextualized to provide value" because they may lack malicious fidelity on their own. A lead can initiate investigation without itself proving a detection.

   Reference: Behind the Curtain: Falcon OverWatch Hunting Leads Explained — What Is a Hunting Lead?

8. 8An intruder sends a malicious attachment to a target as part of an attack. Which cyber kill chain phase does this action illustrate?

   1. A.Installation
   2. B.DeliveryCorrect answer: B
   3. C.Exploitation
   4. D.Command and control

   Explanation: The vendor describes delivery: "For example, the attacker may send email attachments or a malicious link to spur user activity to advance the plan." Sending the attachment is delivery; execution, installation and remote control are separate later behaviors.

   Reference: What Is the Cyber Kill Chain? — 8 Phases of the Cyber Kill Chain Process, Phase 3: Delivery

9. 9In CrowdStrike's documented web-shell workflow, what scope does the pre-populated Advanced event search query use after the analyst selects Investigate event?

   1. A.The process associated with the detectionCorrect answer: A
   2. B.Every process in the organization
   3. C.Every interactive session of the affected user
   4. D.All processes on the affected host

   Explanation: CrowdStrike states that the action "automatically redirects to the Advanced event search with a pre-populated query scoped to the affected process." The query starts with that process rather than an organization-wide or user-only scope.

   Reference: Advanced Web Shell Detection and Prevention — Investigating Web Shell Detections in the Falcon Console

10. 10In CrowdStrike's documented ransomware investigation, the origin system was known but the most recently logged-on user was not. Which Investigate search did the analysts use to identify that user?

    1. A.Host SearchCorrect answer: A
    2. B.User Search
    3. C.Bulk Domain Search
    4. D.Hash Search

    Explanation: In a documented investigation, CrowdStrike reports that "it was possible to use Host Search in the Investigate app to identify the most recently logged-on user". User Search was then used to investigate where that account had logged in.

    Reference: Response When Minutes Matter: Rising Up Against Ransomware — Finding Patient Zero