CCFH-202 Practice Test

CCFH-202 practice test: what's covered

• Falcon Threat Hunting
• Event Search
• MITRE ATT&CK
• Investigate

Free CCFH-202 sample questions

1. Threat hunting is BEST distinguished from alert triage by the fact that hunting is:

   • A. Waiting for the EDR to alert and then responding
   • B. A PROACTIVE, hypothesis-driven search for adversary activity that may NOT have triggered an automated detection — assuming compromise and looking for evidence
   • C. Identical to running antivirus scans
   • D. Only done after a confirmed breach
   Show answer

   Correct: B. Hunting is proactive and hypothesis-led ("assume breach"): you look for adversary behavior that evaded automated detections. Triage is reactive (work the alerts the system already raised). CCFH is fundamentally about proactive hunting.

2. A good hunting HYPOTHESIS is BEST described as:

   • A. A random query
   • B. A testable statement about likely adversary activity (e.g., "an attacker is using scheduled tasks for persistence on finance hosts") that drives a focused, falsifiable search
   • C. A list of all alerts
   • D. A firewall rule
   Show answer

   Correct: B. A hypothesis is specific and testable — it states what behavior you expect to find and where, so the hunt can confirm or refute it. Vague "look for bad stuff" hunts waste effort. Frame, test, refine.

3. Which TWO are valid sources for generating hunting leads/hypotheses? (Choose 2)

   • A. Threat intelligence (new TTPs/IOCs from a recent campaign)
   • B. MITRE ATT&CK techniques relevant to your environment
   • C. The office Wi-Fi password
   • D. Printer toner levels
   Show answer

   Correct: A and B. Lead sources: threat intel (fresh TTPs/IOCs), ATT&CK techniques, anomalies in telemetry, past incidents, and crown-jewel risk. These seed testable hypotheses. Wi-Fi passwords/toner are not hunting inputs.

4. After a hunt finds NO evidence of the hypothesized activity, the correct conclusion is:

   • A. The hunt was a waste of time
   • B. The hypothesis was not confirmed for the scope/time searched — document the negative result, refine the hypothesis or coverage, and feed learnings into detections; absence of evidence is still valuable
   • C. The environment is permanently clean
   • D. Disable the EDR
   Show answer

   Correct: B. A "negative" hunt still has value: it bounds risk, validates coverage, and informs new detections. Document it, refine, and iterate. It does NOT prove the environment is clean forever — only for what/where/when you searched.

5. A successful, repeatable hunt that finds real malicious behavior should be:

   • A. Forgotten
   • B. Operationalized — turned into a custom detection / scheduled search / report so the behavior is caught automatically in future (converting one-time insight into durable detection)
   • C. Run manually forever
   • D. Advertised via BGP
   Show answer

   Correct: B. The hunt → detection feedback loop is core: when a hunt reliably surfaces malicious activity, codify it (custom IOA, scheduled search, report) so it auto-detects. This continuously raises the automated-detection baseline.

Last updated: 2026-10-19

CCFH-202 practice test FAQ