CrowdStrike Certified Falcon Hunter (CCFH-202) is a hunter-level CrowdStrike certification exam. The blueprint splits the exam across 5 domains, starting with Threat Hunting, Indicator Analysis, Query Building. On exam day you face around 60 questions in 90 minutes, in formats such as multiple-choice. The 20 questions below are free samples written to match that style: answer each one first, then reveal the correct answer and note which topics you miss. The CCFH-202 is rated hard in difficulty, and most candidates prepare with at least 12 months of hands-on experience. Because every answer is revealed in place, you can work through the whole set without leaving this page. Work through all 20 samples before deciding whether to buy the full 86+ question PDF.
Looking for more? Click here to get the full PDF with 86+ practice questions for $10 for offline study and deeper preparation.
Which structured analytic technique contrasts different hypotheses to determine which is the best leading (prioritized) hypothesis?
Which of the following is a recommended technique to find unique outliers among a set of data in the Falcon Event Search?
You are reviewing a list of domains recently banned by your organization's acceptable use policy. In particular, you are looking for the number of hosts that have visited each domain. Which tool should you use in Falcon?
To view Files Written to Removable Media within a specified timeframe on a host within the Host Search page, expand and refer to the _____________ dashboard panel.
Which of the following process trees should raise the most suspicion that adversary activity may be present on a web server?
Suspicious RDP connections have been observed on a host within your environment. How do you utilize Event Search to show all connections on this specific host?
Which tool allows a threat hunter to populate and colorize all known adversary techniques in a single view?
What Investigate tool would you use to allow an analyst to view all events for a specific host?
While on the Statistics tab in Event Search you can click on results to perform a number of actions. If you select “Exclude from results” what happens?
To find events that are outliers inside a network, ___________is the best hunting method to use.
Which of the following best describes the purpose of the Mac Sensor report?
What do you click to jump to a Process Timeline from many pages in Falcon, such as a Hash Search?
What information is provided when using IP Search to look up an IP address?
When exporting the results of the following event search, what data is saved in the exported file (assuming Verbose Mode)? event_simpleName=*Written | stats count by ComputerName
The Process Timeline Events Details table will populate the Parent Process ID and the Parent File columns when the cloudable Event data contains which event field?
Which report would you use to find when a specific user last reset their password?
When configuring a custom alert, how do you separate recipient email addresses if including more than 1 recipient?
SPL (Splunk) eval statements can be used to convert Unix times (Epoch) into UTC readable time. Which eval function is correct?
In which of the following stages of the Cyber Kill Chain does the actor not interact with the victim endpoint(s)?
You want to produce a list of all event occurrences along with selected fields such as the full path, time, username etc. Which command would be the appropriate choice?
No. They are original practice questions written to match the format and topic mix of the CrowdStrike Certified Falcon Hunter exam, which contains around 60 questions. Treat them as representative practice, not leaked exam content.
This page includes 20 questions, each with its correct answer you can reveal in place. The full study PDF expands that to 86+ questions.
Yes. Open the answer panel under each question to see which option is correct. Answer first, then reveal, so the set works as a self-check rather than a reading exercise.
Not on its own. Use the samples to find weak topics, revise them against the official domains, then work through the full 86+ question set under timed conditions before booking the exam.
Download the complete CCFH-202 study bundle with 86+ questions in a single printable PDF.