CrowdStrike CCFH-202b Exam - Topic 5 Question 1 Discussion

Actual exam question for CrowdStrike's CCFH-202b exam

Question #: 1
Topic #: 5

When exporting the results of the following event search, what data is saved in the exported file (assuming Verbose Mode)? event_simpleName=*Written | stats count by ComputerName

AThe text of the query

BThe results of the Statistics tab

CNo data Results can only be exported when the 'table' command is used

DAll events in the Events tab

Show Suggested Answer

Suggested Answer: B

When exporting the results of an event search, the data that is saved in the exported file depends on the mode and the tab that is selected. In this case, the mode is Verbose and the tab is Statistics, as indicated by the stats command. Therefore, the data that is saved in the exported file is the results of the Statistics tab, which shows the count of events by ComputerName. The text of the query, all events in the Events tab, and no data are not correct answers.

by Delisa at Jan 28, 2026, 12:17 PM

Limited Time Offer

25%

Off

Get Premium CCFH-202b Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Geraldine

4 days ago

I bet the exam writer is just trying to trick us with these answer choices. But I'm sticking with B!

upvoted 0 times

...

Shelton

9 days ago

B) Definitely the results of the Statistics tab. Anything else would just be a waste of time.

upvoted 0 times

...

Lenna

14 days ago

D) All events in the Events tab? Haha, nice try, but that's not what the question is asking for.

upvoted 0 times

...

Amber

20 days ago

A) The text of the query? Nah, that doesn't make sense. The exported file should have the actual data, not just the query.

upvoted 0 times

...

Stephaine

25 days ago

C) No data? Really? That can't be right. I'm pretty sure the exported file would contain the results.

upvoted 0 times

...

Francesco

30 days ago

B) The results of the Statistics tab seems like the correct answer here.

upvoted 0 times

...

Elvera

1 month ago

I believe it exports all the events in the Events tab, but I need to double-check that against similar practice questions.

upvoted 0 times

...

Tamala

1 month ago

I feel like the query itself might be saved in the exported file, but I can't recall if that's correct.

upvoted 0 times

...

Lynda

2 months ago

I'm not entirely sure, but I remember something about needing to use the "table" command to export data properly.

upvoted 0 times

...

Yoko

2 months ago

I think the exported file should include the results from the Statistics tab since we're using the stats command.

upvoted 0 times

...

Devora

2 months ago

I think the key here is the use of the "stats" command. That's going to give me the aggregated results, which would be saved in the exported file in Verbose Mode. So I'm confident that the answer is B.

upvoted 0 times

...

Belen

3 months ago

I'm a bit confused here. The question says "Results can only be exported when the 'table' command is used", but the query doesn't have a "table" command. I'm not sure if that's a trick or if the question is just worded strangely. I'll have to guess on this one.

upvoted 0 times

...

Tyisha

3 months ago

Okay, let me walk through this step-by-step. The question is asking about exporting the results of an event search using the "event_simpleName=*Written | stats count by ComputerName" query. In Verbose Mode, I believe the exported file would include the full query text, as well as the aggregated results from the Statistics tab. So I'm going to go with answer B.

upvoted 0 times

...

Milly

3 months ago

Hmm, I'm not sure about this one. The question mentions the "stats" command, so I'm wondering if the exported file would include more than just the Statistics tab results. I'll have to think this through carefully.

upvoted 0 times

...

Edna

3 months ago

I think the answer is B. The results of the Statistics tab would be saved in the exported file when using Verbose Mode.

upvoted 0 times

...