CrowdStrike Exam CCFH-202 Topic 9 Question 20 Discussion

Actual exam question for CrowdStrike's CCFH-202 exam

Question #: 20
Topic #: 9

[All CCFH-202 Questions]

What kind of activity does a User Search help you investigate?

AA history of Falcon Ul logon activity

BA list of process activity executed by the specified user account

CA count of failed user logon activity

DA list of DNS queries by the specified user account

Show Suggested Answer

Suggested Answer: B

User Search is an Investigate tool that helps you investigate a list of process activity executed by the specified user account. It shows information such as process name, command line, parent process name, parent command line, etc. for each process that was executed by the user account on any host in your environment. It does not show a history of Falcon UI logon activity, a count of failed user logon activity, or a list of DNS queries by the specified user account.

by Bettyann at May 29, 2024, 10:38 AM

Limited Time Offer

25%

Off

Get Premium CCFH-202 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Dacia

1 years ago

Definitely not option A - that's login history, not user activity. Gotta be one of the other choices, but which one...?

upvoted 0 times

...

Leontine

1 years ago

A count of failed logins could be useful, but I don't think that's the main purpose of the User Search. I'm leaning towards option D.

upvoted 0 times

Kristofer

1 years ago

I think option B could also be helpful in understanding the process activity of the user account.

upvoted 0 times

...

Rossana

1 years ago

I agree, option D seems like the most relevant for investigating user activity.

upvoted 0 times

...

Willis

1 years ago

Hmm, I'm not sure if the User Search would give you a list of processes. That sounds more like something you'd get from a process or event log.

upvoted 0 times

Lillian

1 years ago

B) A list of process activity executed by the specified user account

upvoted 0 times

...

Casie

1 years ago

A) A history of Falcon Ul logon activity

upvoted 0 times

...

Margurite

1 years ago

I agree with Lili, because it can provide valuable information about what actions were taken by a specific user.

upvoted 0 times

...

Wilford

1 years ago

The User Search seems to be more about user activity, not login history. I'd go with option B.

upvoted 0 times

Effie

1 years ago

I think option A could also be useful to track the history of Falcon Ul logon activity.

upvoted 0 times

...

Malcom

1 years ago

I agree, option B seems to be the most relevant for investigating user activity.

upvoted 0 times

...

Dorsey

1 years ago

I think option A could also be useful, but option B is definitely more focused on user activity.

upvoted 0 times

...

Pura

1 years ago

I agree, option B seems to be the most relevant for investigating user activity.

upvoted 0 times

...

Vivan

1 years ago

I see your point, option B does seem to focus more on the process activity executed by the user account.

upvoted 0 times

...

Isidra

1 years ago

I think option A could also be useful to track the history of Falcon Ul logon activity.

upvoted 0 times

...

Vanesa

1 years ago

I agree, option B seems to be the most relevant for investigating user activity.

upvoted 0 times

...

Lili

1 years ago

I think a User Search helps investigate B) A list of process activity executed by the specified user account.

upvoted 0 times

...