CrowdStrike CCFH-202b Exam - Topic 5 Question 1 Discussion

Actual exam question for CrowdStrike's CCFH-202b exam

Question #: 1
Topic #: 5

When exporting the results of the following event search, what data is saved in the exported file (assuming Verbose Mode)? event_simpleName=*Written | stats count by ComputerName

AThe text of the query

BThe results of the Statistics tab

CNo data Results can only be exported when the 'table' command is used

DAll events in the Events tab

Show Suggested Answer

Suggested Answer: B

When exporting the results of an event search, the data that is saved in the exported file depends on the mode and the tab that is selected. In this case, the mode is Verbose and the tab is Statistics, as indicated by the stats command. Therefore, the data that is saved in the exported file is the results of the Statistics tab, which shows the count of events by ComputerName. The text of the query, all events in the Events tab, and no data are not correct answers.

by Delisa at Jan 28, 2026, 12:17 PM

Limited Time Offer

25%

Off

Get Premium CCFH-202b Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Lynda

8 days ago

I'm not entirely sure, but I remember something about needing to use the "table" command to export data properly.

upvoted 0 times

...

Yoko

13 days ago

I think the exported file should include the results from the Statistics tab since we're using the stats command.

upvoted 0 times

...

Devora

18 days ago

I think the key here is the use of the "stats" command. That's going to give me the aggregated results, which would be saved in the exported file in Verbose Mode. So I'm confident that the answer is B.

upvoted 0 times

...

Belen

23 days ago

I'm a bit confused here. The question says "Results can only be exported when the 'table' command is used", but the query doesn't have a "table" command. I'm not sure if that's a trick or if the question is just worded strangely. I'll have to guess on this one.

upvoted 0 times

...

Tyisha

28 days ago

Okay, let me walk through this step-by-step. The question is asking about exporting the results of an event search using the "event_simpleName=*Written | stats count by ComputerName" query. In Verbose Mode, I believe the exported file would include the full query text, as well as the aggregated results from the Statistics tab. So I'm going to go with answer B.

upvoted 0 times

...

Milly

1 month ago

Hmm, I'm not sure about this one. The question mentions the "stats" command, so I'm wondering if the exported file would include more than just the Statistics tab results. I'll have to think this through carefully.

upvoted 0 times

...

Edna

1 month ago

I think the answer is B. The results of the Statistics tab would be saved in the exported file when using Verbose Mode.

upvoted 0 times

...