ExamTopics Logo
Mail Us[email protected]
Menu
Crowdstrike Discussions
exam questions

Exam CCFH-202 All Questions

View all questions & answers for the CCFH-202 exam
Go to Exam

Exam CCFH-202 topic 1 question 25 discussion

Actual exam question from CrowdStrike's CCFH-202
Question #: 25
Topic #: 1
[All CCFH-202 Questions]

Which of the following is the proper method to quantify search results, enabling a hunter to quickly sort and identify outliers?

  • A. Using the “| stats count by” command at the end of a search string in Event Search
  • B. Using the “|stats count” command at the end of a search string in Event Search
  • C. Using the “|eval” command at the end of a search string in Event Search
  • D. Exporting Event Search results to a spreadsheet and aggregating the results
Show Suggested Answer Hide Answer
Suggested Answer: A 🗳️
by Chiquitabandita at Sept. 8, 2023, 8:55 a.m.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
alanalanalan
10 months ago
Selected Answer: A
Answer : A A. Using the “| stats count by” command at the end of a search string in Event Search keyword : stats count by Reference : Investigating and Querying Event Data with Falcon EDR
upvoted 1 times
...
five55
1 year, 1 month ago
Selected Answer: A
100 percent A
upvoted 1 times
...
five55
1 year, 1 month ago
Selected Answer: A
I think B is wrong because stats count "by" has to be there
upvoted 1 times
...
gr23
1 year, 4 months ago
Answer is A. stats count BY. Look at any of the sample queries CS gives you on their blogs and they all have stats count BY.
upvoted 1 times
...
Chiquitabandita
1 year, 8 months ago
I think this is a bad question though, you could use stats count or stats count by, it depends on what the desired outcome is and it is not specified in the question clearly.
upvoted 1 times
...
Chiquitabandita
1 year, 8 months ago
Selected Answer: A
The "| stats count by" command allows you to aggregate and count results based on specific fields, which is useful for quantifying and summarizing search results and identifying outliers based on different criteria.
upvoted 2 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago