What is the format of the CCFH exam?
The CrowdStrike Certified Falcon Hunter (CCFH) exam is a 90-minute, 60-question assessment. CrowdStrike's exam guide describes it as the final step toward the CCFH certification, evaluating whether you can work a detection in the Falcon console and Investigate app, use pre-built queries and automated reports for machine auditing and proactive investigation, and write search queries in the CrowdStrike Query Language (CQL).
CrowdStrike does not publish a numeric passing score. The guide requires candidates to 'achieve a passing score' and leaves it there - any third party quoting an exact CCFH pass percentage is guessing.
What topics does the CCFH exam cover?
The published exam scope has seven topic areas, and they read like a threat hunter's job description. Behind them, the scored objectives are concrete: apply the cyber kill chain, model and operationalize MITRE ATT&CK behaviors and TTPs, read Host Timeline and Process Timeline output, pivot from a detection into investigative tools, interpret file and process metadata, and pick the right search option - Users, Hosts, Hash, IP addresses, or Bulk domains - for the question in front of you.
CrowdStrike recommends at least six months of hands-on Falcon experience plus its own Falcon Support Documentation titles (Falcon Management, Endpoint Security, Event Investigation, Hunting Guides) before sitting.
Notice the weight on process, not trivia. Five of the seven areas are about working an investigation - reading, searching, reporting, analyzing, structuring - rather than recalling definitions. That is why CrowdStrike frames six months of platform time as the real prerequisite, and why candidates who only watch walkthrough videos struggle when the exam hands them a scenario.
CQL - CrowdStrike Query Language, per the exam guide - is the center of gravity inside that scope. The Event Search area asks you to write simple and intermediate CQL queries, and the search-and-investigation area asks you to pick the right Investigate module tool for the job. Candidates who treat CCFH as a reading exam discover the difference between recognizing a query and producing one under a 90-minute clock; the guide's six-month experience recommendation exists precisely because query fluency only comes from reps inside the console.
| # | Scope area | What it means in practice |
|---|---|---|
| 1 | MITRE ATT&CK Frameworks | Model threat actor behavior and operationalize TTPs |
| 2 | Detection Analysis | Read detections, host states, and process flows correctly |
| 3 | Search and Investigation Tools | Choose and use the right Investigate module tool |
| 4 | Event Search | Write simple and intermediate CQL queries |
| 5 | Reports and References | Pre-built queries and automated reports for audits |
| 6 | Hunting Analytics | Turn data into a hunting hypothesis you can test |
| 7 | Hunting Methodology | Structured proactive investigation, end to end |
Scroll horizontally to view all columns.
How much does the CCFH exam cost?
$250 USD per exam, per the CrowdStrike Falcon Certification Program guide. The voucher is purchased through your CrowdStrike sales representative or online at Pearson, and every registrant must accept the CrowdStrike Certification Exam Agreement and be at least 18 years old.
The retake policy is the expensive part. A failed attempt costs another full $250, plus a mandatory 48-hour wait before attempt two and a seven-day wait before attempt three and beyond. A fourth performance failure means a 30-day wait, retaken recommended training, and a review with the CrowdStrike Certification Manager before a fifth attempt is approved.
Can you take the CCFH exam at home?
Yes. Pearson VUE's CrowdStrike program page states the certification programs are 'delivered by Pearson either online (OnVUE) or at a Pearson Testing Center (PVTC)'.
At home, OnVUE's published requirements apply: Windows 10 or macOS 14 or higher, a working webcam, microphone, and speaker with no headphones, one display only, at least 6 Mbps down and 2 Mbps up, and the ability to close every application except OnVUE. Virtual machines, phones, tablets, smart devices with recording or AI features, secondary displays, VPNs, and corporate or public networks are prohibited, and failing the requirements on exam day can mean immediate cancellation and forfeiture of the exam fee.
How long does the CCFH certification last?
Three years. Recertification requires passing the most current version of the exam when the certification expires - CrowdStrike publishes no continuing-education alternative, and you cannot retake an exam you already passed except for an approved recertification.
That three-year clock matters for planning. If your role or client work depends on holding the credential, an expiring CCFH means facing the current version of the exam again - on whatever the scope looks like then, not the version you originally passed. CrowdStrike reserves the right to change exam content at any time without notice.
If the Sitting Itself Is the Problem
Format research solves the knowing. It does not solve the doing when CQL under a clock, a failed attempt already on the books, or a credential deadline is the real blocker.
That is the gap Exam Assist fills: your CCFH sitting is handled end to end against the current 60-question, 90-minute format, and the service fee is due only after the agreed pass posts. If that is the outcome you actually need, the CCFH service page has the details.
Either way, you now know the real shape of the exam: 60 questions, 90 minutes, $250, seven investigative scope areas with CQL at the center, at home or at a center. The next move is yours - book the sitting yourself, or hand it to a team whose fee only exists if the pass posts.