CCFH-202b
CrowdStrike Certified Falcon Hunter
CCFH-202b Exam Guide: Prepare for the CrowdStrike Certified Falcon Hunter Exam
CCFH refers to CrowdStrike Certified Falcon Hunter, a job-role-based credential for investigative analysts who use the Falcon platform for deeper detection analysis, response, machine timelining, event-related searches, insider-threat investigations, and proactive threat hunting. The official Pearson VUE page does not display the specific suffix “CCFH-202b,” so confirm that your booking and exam guide identify the intended version before scheduling. This guide helps you decide whether your hands-on experience is sufficient, what to practise first, and whether OnVUE or an approved testing-center route fits your circumstances.
What does the CCFH certification validate?
The CCFH certification validates Falcon-platform knowledge and skills associated with investigative analysis rather than basic platform orientation or administrative configuration. CrowdStrike describes CCFH as directed at analysts who perform deeper detection analysis and response, machine timelining, event-related search queries, insider-threat-related investigations, and proactive investigations such as threat hunting. [https://www.pearsonvue.com/us/en/crowdstrike.html]
That description is the most reliable basis for planning because the supplied official material does not provide a detailed public blueprint with domain names, percentage weights, question counts, passing scores, or exam duration. Treat the role description as the confirmed scope, not as a substitute for a candidate-specific exam guide or current CrowdStrike University material.
The credential is therefore best approached as an applied investigation assessment. A candidate should be able to connect evidence, use Falcon workflows logically, distinguish an initial signal from a defensible conclusion, and choose an appropriate next investigative action. Memorising isolated interface labels is a weaker preparation strategy than learning how the platform supports an investigation from first alert through documented response.
The role the credential is aimed at
The intended audience is the investigative analyst who goes beyond reviewing a single detection. This may include a threat hunter, senior SOC analyst, incident investigator, or responder whose work includes examining host activity over time, querying related events, investigating possible insider activity, and proactively looking for adversary behaviour. [https://www.pearsonvue.com/us/en/crowdstrike.html]
The official description does not state that a particular job title, employer type, degree, or external certification is required. Decide based on your actual Falcon responsibilities, not on whether your title contains “hunter.”
What the suffix CCFH-202b means for scheduling
Pearson VUE’s permitted CrowdStrike page identifies CCFH as CrowdStrike Certified Falcon Hunter, but it does not display the specific suffix “CCFH-202b.” [https://www.pearsonvue.com/us/en/crowdstrike.html] Before paying or applying a voucher, compare the code in your employer or training records with the code shown in your Pearson account and the current official exam documentation.
Do not assume that a suffix identifies a published blueprint, a retake version, or a guaranteed exam release. If the booking page presents a different title or code, pause and ask CrowdStrike certification support for confirmation at [email protected], an address provided on the official certification page. [https://www.pearsonvue.com/us/en/crowdstrike.html]
Who should take CCFH, and who should wait?
CCFH is a sensible target for a Falcon user whose regular work involves investigating detections, reconstructing host or user activity, searching related events, and pursuing hypotheses beyond the first alert. It is less suitable as a first exposure to Falcon. CrowdStrike recommends relevant University training and at least 6 months of experience with the Falcon platform, although Pearson VUE states that there are no training prerequisites for attempting an exam. [https://www.pearsonvue.com/us/en/crowdstrike/fal-con.html]
Use the experience recommendation as a readiness test
Pearson VUE states that candidates should have at least 6 months’ experience working in Falcon because the questions measure knowledge and skills gained through hands-on experience. [https://www.pearsonvue.com/us/en/crowdstrike.html] The Fal.Con information similarly recommends at least 6 months of Falcon-platform experience. [https://www.pearsonvue.com/us/en/crowdstrike/fal-con.html] This is guidance, not a stated eligibility gate.
A practical readiness check is whether you can explain why you would take each investigative step, what evidence would support or weaken a hypothesis, and how you would continue when the first search produces incomplete results. If your experience consists mainly of viewing assigned detections without conducting follow-up analysis, build more supervised practice before booking.
Do not count time alone as competence. Six months of repetitive, shallow activity may leave gaps, while varied work across detections, hosts, users, timelines, and searches may provide stronger preparation. Keep a list of investigations you have performed and mark which CCFH activity each one exercised.
Training and access decisions
There are no training prerequisites for exam attempts, but CrowdStrike strongly recommends training through CrowdStrike University and relevant Falcon experience. [https://www.pearsonvue.com/us/en/crowdstrike/fal-con.html] Falcon-platform customers receive free access to CrowdStrike University, including 100-level eLearning courses and certification practice exams; University is available from the Falcon console or CrowdStrike Customer Center. [https://www.pearsonvue.com/us/en/crowdstrike/fal-con.html]
Start with the recommended CCFH-aligned learning path if you can access it. If instructor-led courses require training credits, separate that purchase decision from the exam decision rather than assuming the course is mandatory. Use the official training catalogue and current exam guide to identify the learning sequence that matches the version shown in your account.
Which skills should your study plan cover?
Build your plan around five connected investigation capabilities: analysing detections deeply, reconstructing machine activity over time, forming and testing event-related searches, investigating insider-threat indicators, and hunting proactively. These are the areas named in CrowdStrike’s CCFH audience description. [https://www.pearsonvue.com/us/en/crowdstrike.html] The official sources supplied here do not publish percentage weights, so do not assign invented priorities or treat an unofficial breakdown as a blueprint.
Deeper detection analysis and response
Practise moving from a detection to a reasoned investigation. Review the initiating evidence, affected host or user, process relationships, timing, and related activity. Then decide whether the evidence supports containment, additional scoping, escalation, or continued observation. The key preparation goal is not to memorise a response button; it is to understand what the available evidence means and what question should be answered next.
For each practice case, write a short investigation record containing the initial signal, working hypothesis, evidence examined, alternative explanation, confidence level, and next action. This exposes a common weakness: treating the detection summary as the conclusion. A strong analyst asks what happened before and after the recorded event and whether the same pattern exists elsewhere.
Machine timelining
Machine timelining requires you to reconstruct activity in sequence rather than inspect events as unrelated rows. Practise arranging relevant process, file, network, user, and detection evidence around a time window, then identifying the earliest meaningful precursor and the later outcome. The official CCFH description specifically names machine timelining, so it deserves deliberate practice rather than incidental exposure. [https://www.pearsonvue.com/us/en/crowdstrike.html]
Use deliberately incomplete scenarios. Hide one expected event and ask what evidence you would seek to fill the gap. This develops chronological reasoning without relying on live exam questions. Also practise explaining uncertainty: timestamps, collection coverage, and event context may not establish causation by themselves.
Event-related search queries
Study searches as investigation tools. Begin with a precise question, identify the fields or relationships needed to answer it, and broaden only when the result is too narrow. Then validate whether the returned events actually address the question. CCFH’s official role description includes event-related search queries, making query purpose and interpretation more important than copying syntax from a memorisation sheet. [https://www.pearsonvue.com/us/en/crowdstrike.html]
Create practice prompts such as: find activity associated with a particular host during a defined period; identify related events around a detection; or locate similar behaviour across systems. Use your authorised Falcon environment and documentation. Record why a filter was added, what it excludes, and how you would avoid mistaking an empty result for proof that activity did not occur.
Insider-threat investigations
Insider-threat work calls for careful correlation of identity, access, endpoint activity, timing, and business context. It is not a licence to label a person from one unusual event. Practise separating observable behaviour from interpretation, identifying what additional evidence is needed, and escalating according to organisational policy. The CCFH role description explicitly includes insider-threat-related investigations. [https://www.pearsonvue.com/us/en/crowdstrike.html]
A useful exercise is to compare two explanations for the same activity: authorised administrative work and suspicious misuse. List the evidence that would distinguish them. This trains disciplined analysis and reduces the pitfall of confirmation bias, where the analyst searches only for facts supporting the first suspicion.
Proactive threat hunting
Threat hunting starts with a hypothesis or behavioural question and searches for evidence that may not have produced a high-confidence detection. Practise defining the behaviour, selecting a useful scope, searching for related activity, and deciding how to handle both positive and negative findings. The official CCFH description names proactive investigations and threat hunting as core role activities. [https://www.pearsonvue.com/us/en/crowdstrike.html]
Do not turn hunting practice into random browsing. For each hunt, state the hypothesis, data needed, initial scope, pivot conditions, expected benign explanations, and action if evidence is found. This makes your reasoning transferable to unfamiliar scenarios and keeps the exercise separate from any attempt to obtain unauthorised exam content.
How should you sequence preparation?
Use a progression from platform orientation to guided investigations, then independent hunts and timed decision practice. The sequence matters: candidates who begin with broad hunting often miss basic evidence relationships, while candidates who only complete introductory lessons may lack the investigative judgement CCFH is intended to assess. CrowdStrike recommends completing aligned CrowdStrike University training, so use that material as the backbone and add hands-on exercises where your access permits. [https://www.pearsonvue.com/us/en/crowdstrike.html]
Stage one: map the role to your current work
Before studying, make a gap map with five columns: detection analysis and response, machine timelining, event-related searches, insider-threat investigations, and threat hunting. For each column, record one task you can perform independently, one task requiring assistance, and one concept you cannot yet explain. This is a practical recommendation based on the official role description, not an official scoring model.
Use the map to choose study order. Start with the area that blocks several others. For example, weak event interpretation can undermine both timelines and hunting, while weak search design can prevent you from validating a detection. Avoid spending the first study sessions on topics you already perform confidently simply because they feel easier.
Stage two: complete aligned learning
Work through the CCFH-relevant CrowdStrike University material in order, taking notes in terms of decisions rather than screen labels. After each lesson, answer three questions: what problem does this workflow solve, what evidence does it expose, and what could produce a misleading result? Customers can access 100-level eLearning courses and certification practice exams through CrowdStrike University. [https://www.pearsonvue.com/us/en/crowdstrike/fal-con.html]
If a practice exam identifies a weak area, return to the relevant lesson and perform a hands-on exercise. Do not treat practice questions as a list of answers to memorise. Their value is in revealing whether you can distinguish similar choices and explain why one investigative action is better supported.
Stage three: practise complete investigations
Run end-to-end exercises that begin with a detection or behavioural hypothesis and finish with a documented disposition. Include a timeline, related searches, scope expansion, competing explanations, and a response recommendation. Use authorised lab, customer, or training data only. You do not need access to live exam questions to build the reasoning CCFH demands.
Ask a peer or supervisor to review the investigation record for unsupported leaps. Have them challenge your assumptions: What evidence makes this suspicious? What benign explanation remains? What would you search next? This feedback is more useful than simply repeating the same comfortable workflow.
Stage four: rehearse under constraints
Near scheduling, practise making a defensible choice from a compact scenario without looking up every term. Focus on reading the question precisely, identifying the investigation objective, eliminating actions that do not answer it, and selecting the option supported by the evidence presented. The official sources supplied do not state CCFH question counts, duration, scoring, or passing standard, so create your own short drills without presenting them as exam simulations.
Review mistakes by category: misunderstood evidence, wrong sequence, unsupported assumption, missed scope, or careless reading. A mistake log should contain the corrected reasoning, not only the selected answer. Stop adding new topics when your errors are mostly interpretation and prioritisation issues; consolidate instead.
What practical exercises build CCFH capability?
The strongest exercises require you to explain a conclusion and the evidence behind it. Use authorised Falcon data or official training resources to work through a detection, build a machine timeline, search related events, test an insider-threat hypothesis, and conduct a proactive hunt. Keep each exercise reproducible so you can revisit the reasoning rather than relying on memory of a particular screen.
Detection-to-scope exercise
Select a permitted detection and write the investigation question before opening additional views. Identify the affected asset and identity, review the initiating activity, examine nearby events, and decide how far to scope. Document what would justify containment or escalation and what evidence would make you lower confidence.
The common mistake is to close the case as soon as the initial detection appears plausible. A better exercise asks whether the activity is isolated, whether related systems show the same behaviour, and whether the timeline supports the proposed sequence.
Timeline reconstruction exercise
Build a chronological table from available endpoint evidence. Label each item as observation, interpretation, or unresolved question. Then write a narrative that does not claim more than the evidence supports. If two events are close in time but their relationship is uncertain, say so and identify the pivot that could resolve it.
This exercise improves both analysis and communication. It also reveals whether you are overlooking earlier activity because you began with the alert timestamp rather than the broader investigative window.
Hypothesis-driven hunt exercise
Choose a behaviour-based hypothesis, define the population to search, and specify what finding would confirm, weaken, or refute it. Begin narrowly, expand deliberately, and record benign explanations. Finish by stating whether the result warrants a detection, further investigation, or no action.
Do not confuse a large result set with a successful hunt. A useful result is one that answers the question, identifies a meaningful outlier, or shows that the hypothesis needs refinement.
External data and SIEM context
If your responsibilities include Splunk, understand the boundary between Falcon evidence and downstream analysis. The Splunk Add-on for CrowdStrike FDR collects CrowdStrike event data into Splunk for retention and further analysis and provides CIM-compatible knowledge for other Splunk apps. [https://splunkbase.splunk.com/app/5579] Practise confirming the source, time range, field meaning, and normalisation before relying on an external view.
Do not assume that familiarity with a Splunk integration replaces Falcon investigation knowledge. The CCFH official description focuses on investigative analysis in the Falcon platform. Use SIEM work as supporting context unless the current official CCFH guide for your booked version states otherwise.
What mistakes reduce preparation quality?
The most damaging mistakes are not usually a missing menu label; they are weak investigative habits. Candidates often study passively, treat one detection as a complete answer, search without a hypothesis, and confuse an empty result with evidence of absence. Correct these habits through written reasoning and supervised hands-on practice rather than by collecting more disconnected notes.
Relying on a title or code without verifying the exam
Because the supplied official page names CCFH but does not display “CCFH-202b,” verify the exact exam identity before scheduling. [https://www.pearsonvue.com/us/en/crowdstrike.html] A code in a third-party catalogue may be an internal identifier, while Pearson’s booking record may use the certification name. Save the official exam guide associated with the booking and check that your training plan matches it.
Do not infer exam content from a neighbouring credential. CCFP, CCFA, and CCFR serve different roles, while CCFH is aimed at investigative analysts. The official page lists these as separate certifications. [https://www.pearsonvue.com/us/en/crowdstrike.html]
Memorising practice answers
Practice exams are useful for discovering gaps, but memorising answer patterns does not establish investigation skill. Rework each item by explaining the objective, relevant evidence, tempting but weaker alternatives, and the next action. Never use leaked questions or exam dumps; they are not a legitimate substitute for training and do not guarantee a pass.
If you cannot explain an answer without seeing the options, mark the concept for hands-on review. A smaller set of well-understood workflows is more valuable than a large answer bank detached from evidence.
Ignoring operational constraints
Candidates who choose online delivery without checking their equipment or testing space create an avoidable scheduling risk. Pearson requires a compatible operating system, specified connectivity, a working webcam and audio setup, one display, and a compliant room for OnVUE. [https://www.pearsonvue.com/us/en/crowdstrike/onvue.html] Test the same device and network you plan to use.
Candidates also lose time when they study only the interface and not the investigation objective. For every workflow, ask what decision it supports. That question keeps preparation aligned with the job role instead of turning it into navigation practice.
Should you choose OnVUE or a Pearson Testing Center?
CrowdStrike certification programs are delivered by Pearson either online through OnVUE or at a Pearson Testing Center, giving candidates a choice between a controlled local center and a remote appointment. [https://www.pearsonvue.com/us/en/crowdstrike.html] Choose OnVUE only after confirming the technology, room, ID, and conduct requirements; choose a testing center if your home network, workspace, or privacy cannot reliably meet them.
OnVUE technology and room requirements
Pearson’s listed minimum OnVUE requirements include Windows 10 or macOS 14 or higher, a working webcam, microphone and speaker, one display, and internet speeds of at least 6 Mbps download and 2 Mbps upload. [https://www.pearsonvue.com/us/en/crowdstrike/onvue.html] Headphones or headsets are not permitted under the listed requirements, and virtual machines, VPNs, corporate networks, and public or shared networks are listed among prohibited technology or environments.
The desk must be empty except for the testing computer, pre-approved items, comfort aids, and a beverage in an unmarked container. The room must be quiet, free of distractions, and occupied only by you. [https://www.pearsonvue.com/us/en/crowdstrike/onvue.html] Run Pearson’s system test on the same device and network before exam day, close other applications, and arrange a backup plan if the environment cannot be made compliant.
Check-in, identification, and conduct
OnVUE check-in includes technology checks, photographs of you and your ID, and a 360° room scan. Pearson states that if a requirement is not met, you cannot test and your fee will be forfeited. [https://www.pearsonvue.com/us/en/crowdstrike/onvue.html] Begin check-in 30 minutes before the appointment, and ensure the name on your booking matches your valid, government-issued photo ID.
During the session, do not leave the webcam view unless the exam confirms you are on an approved break, speak or read aloud unless instructed, access your phone unless explicitly permitted, or allow another person to view the screen. Recording, sharing, cheating, or allowing another person to take the exam can result in revocation and forfeiture of the fee. [https://www.pearsonvue.com/us/en/crowdstrike/onvue.html]
When an onsite event is relevant
Fal.Con 2026 lists CCFH among the available onsite CrowdStrike exams. The listed CCFH exam is scheduled for Monday, August 31, 2026, at Mandalay Bay Resort in Las Vegas, Nevada, and candidates must be registered Fal.Con attendees. [https://www.pearsonvue.com/us/en/crowdstrike/fal-con.html] Treat these details as event-specific rather than as the general delivery method for CCFH.
The Fal.Con page lists two delivery sessions: 11:30 a.m.–1:00 p.m. and 2:00–3:30 p.m., with sign-in and ID checks before exam delivery. [https://www.pearsonvue.com/us/en/crowdstrike/fal-con.html] It also states that laptops will be provided and candidates should bring government-issued photo ID. Confirm current availability and appointment details in Pearson before making travel plans.
How do you schedule without creating avoidable risk?
First accept the CSU Certification Agreement, then verify the exact CCFH exam identity, choose the delivery route, and schedule through a Pearson account. The official CrowdStrike page states that a Pearson account is required to schedule, reschedule, or cancel, and that registration can use an exam voucher or credit-card payment. [https://www.pearsonvue.com/us/en/crowdstrike.html] Do not book until your readiness and delivery checks are complete.
Scheduling checklist
Use this order:
1. Review the CrowdStrike University Certification Agreement before scheduling. [https://www.pearsonvue.com/us/en/crowdstrike.html]
2. Confirm that the booking identifies CrowdStrike Certified Falcon Hunter and resolve any discrepancy involving “CCFH-202b.”
3. Complete the relevant University training and practice work, or document why your existing hands-on experience covers the same skills.
4. Decide between OnVUE and a Pearson Testing Center based on privacy, equipment, network stability, and identification requirements.
5. Sign in to or create your Pearson account and apply the voucher or select the available payment method. [https://www.pearsonvue.com/us/en/crowdstrike/fal-con.html]
6. Save the appointment confirmation and recheck the official delivery instructions before the appointment.
The supplied official sources state that the listed credit-card fee for the Fal.Con 2026 onsite event is $250 USD. [https://www.pearsonvue.com/us/en/crowdstrike/fal-con.html] Do not generalise that event-specific fee to every CCFH appointment; confirm the amount shown for your selected delivery route and location.
If you need help
For certification-program questions, Pearson’s CrowdStrike page directs candidates to CrowdStrike certification support at [email protected]. [https://www.pearsonvue.com/us/en/crowdstrike.html] For an OnVUE problem during an exam, use the in-exam chat to contact the proctor; Pearson states that the proctor cannot pause or extend the exam or troubleshoot your device or network. [https://www.pearsonvue.com/us/en/crowdstrike/onvue.html]
If the computer freezes or disconnects, Pearson instructs candidates to close and relaunch OnVUE from the downloads folder; if the issue persists, use the customer-service route for the exam programme. [https://www.pearsonvue.com/us/en/crowdstrike/onvue.html] Record support instructions before starting so that a technical problem does not become a last-minute search exercise.
A practical CCFH study roadmap
A useful roadmap has four phases: establish scope, strengthen platform reasoning, complete investigation drills, and verify readiness. The calendar should follow your experience and access rather than an invented fixed duration. Move forward when you can demonstrate the required behaviour, not merely when you have finished reading a lesson.
Phase one: establish scope and baseline
Confirm the exam title and version shown in your official booking materials. Read the CCFH role description and write down the five named activity areas. [https://www.pearsonvue.com/us/en/crowdstrike.html] Take an honest baseline using an authorised practice resource or a self-created scenario. For each weakness, identify whether the problem is Falcon navigation, evidence interpretation, search design, chronology, or investigative judgement.
At the end of this phase, you should have a personal gap list and a training sequence. If you cannot access the platform or relevant University material, resolve that access issue before scheduling rather than hoping theoretical study will compensate for missing practice.
Phase two: build connected platform knowledge
Complete aligned CrowdStrike University learning and turn each topic into a short workflow note: objective, inputs, useful pivots, expected evidence, limitations, and next decision. Customers can access University through the Falcon console or CrowdStrike Customer Center, and the programme includes 100-level eLearning courses and certification practice exams. [https://www.pearsonvue.com/us/en/crowdstrike/fal-con.html]
At the end of this phase, explain how a detection can lead to a timeline, how a timeline can generate a related-event search, and how findings can change the scope or response. If the connections remain unclear, repeat the hands-on exercise instead of adding unrelated material.
Phase three: investigate and review
Complete several authorised scenarios across the five CCFH activity areas. Vary the starting point: begin with a detection in one exercise, a suspicious identity pattern in another, and a proactive hypothesis in a third. For every case, produce a concise evidence trail and ask another analyst to challenge your conclusion.
At the end of this phase, your review should focus on reasoning quality. Can you identify missing evidence? Can you explain why a search is appropriately scoped? Can you distinguish correlation from causation? Can you state what would change your decision? These questions are practical readiness indicators derived from the published role, not official scoring criteria.
Phase four: verify logistics and readiness
Use the current official exam guide and Pearson booking record to confirm delivery details, then run the OnVUE system test if you selected online delivery. Check your ID, room, network, account, agreement status, and appointment information. [https://www.pearsonvue.com/us/en/crowdstrike/onvue.html] Keep final study focused on your mistake log and investigation sequence.
If your remaining uncertainty is about a platform workflow, practise it. If it is about the exam code, delivery rules, or booking, contact the official support route. Do not solve administrative uncertainty with third-party claims or unofficial question material.
What should you do next?
Your next action depends on the largest unresolved risk: exam identity, experience, skill, or delivery. Confirm “CCFH-202b” against the official Pearson booking record first. Then compare your hands-on Falcon work with the five published CCFH activity areas, use CrowdStrike University where available, and practise investigations that require evidence-based decisions. Schedule only after the delivery and identification checks are also complete.
The official sources support the credential’s role focus, recommended training and experience, Pearson delivery options, OnVUE requirements, and Fal.Con-specific arrangements. They do not support a public CCFH percentage blueprint, question count, passing score, general exam duration, or universal fee. Keep those items unfilled until the current official exam guide or booking page provides them.
A disciplined final review should leave you with three things: a verified exam identity, a written record of investigation mistakes and corrections, and a confirmed appointment setup. That combination is more useful than a longer list of memorised terms because it reflects the applied Falcon work the CCFH certification is intended to assess.
Conclusion
CCFH preparation should resemble investigative work: establish the question, gather and relate evidence, test alternatives, and make a defensible next decision. Confirm the exact certification code before scheduling because the official page identifies CCFH but does not display “CCFH-202b.” Build capability through authorised Falcon practice and aligned CrowdStrike University training, then select OnVUE or a testing center only after checking the applicable Pearson requirements. Keep unsupported exam statistics out of your plan and let the current official guide control final decisions.