CCFH practice examsIn development
CrowdStrike Certified Falcon Hunter
Threat hunting on Falcon telemetry: looking for what detection missed, hypotheses that name the behaviour and what would count as a finding, the event types and fields that decide what can be asked, and frequency analysis exploiting the rarity of malicious activity; then hunting by tactic with persistence and discovery as the productive ones, validation as the larger half of the work, documenting benign findings so they are not re-investigated, and converting a hunt into a rule specific enough not to flood.
What you get
Papers are cut from the bank and weighted like the real exam, and no question appears in two of them. Every wrong answer comes back on later days until you have it right.
What the exam covers
| Hunting method and the event data model | Not published |
| Hunting by tactic, validation and the programme | Not published |
Two sample questions
1. Which tactic covers moving from one host to another inside the network?
- Privilege escalation
- Lateral movement instead — correct
- Command and control
- Discovery
Why: Lateral movement covers techniques used to move from one system to another within the environment.
2. Which past input most sharpens a new hypothesis?
- Lessons from earlier incidents — correct
- The total amount of storage that the telemetry pipeline consumed last quarter
- The console login count
- The number of dashboards
Why: What earlier intrusions looked like tells a hunter where similar activity might hide again.
The real CCFH exam
| Length | 90 minutes |
|---|---|
| Questions | 60 |
| Pass mark | Scaled score; CrowdStrike does not publish the percentage |
| Price | Purchased per attempt through the CrowdStrike certification programme |
| Recommended before you sit it | The Falcon Responder credential and hands-on investigation experience are assumed. |
| Valid for | 2 years |
Exam facts as published by CrowdStrike; always check the vendor’s page before you book.
Study CCFH with Chiron
Chiron is invitation-only while we are in beta, and nothing is for sale yet: invited accounts use every paper, drill and course note for free.