Take My CCFH Exam

What the CCFH Exam Actually Tests

CCFH is the investigative credential in CrowdStrike's role-based program. The official exam guide says it evaluates your ability to respond to a detection inside the Falcon console and Investigate app, use pre-built queries and automated reports for machine auditing and proactive investigation, and run search queries in the CrowdStrike Query Language (CQL).

The published scope has seven topic areas: MITRE ATT&CK Frameworks, Detection Analysis, Search and Investigation Tools, Event Search, Reports and References, Hunting Analytics, and Hunting Methodology. The objectives behind them are concrete: model threat actor behavior with ATT&CK, read the Host Timeline and Process Timeline, pivot from a detection into investigative tools, interpret file and process metadata, and pick the right search - Users, Hosts, Hash, IP, or Bulk domains - for the question in front of you.

One honesty note: CrowdStrike does not publish a numeric passing score for CCFH. The guide says only that candidates must 'achieve a passing score.' Anyone quoting an exact percentage is inventing it.

OnVUE at Home or a Pearson Testing Center

Pearson VUE's CrowdStrike program page states it plainly: the certification programs are 'delivered by Pearson either online (OnVUE) or at a Pearson Testing Center (PVTC)'. Both routes are open for CCFH, and scheduling runs through your Pearson account with a credit card or an exam voucher.

At home, Pearson's published OnVUE requirements apply: Windows 10 or macOS 14 or higher, a working webcam, microphone, and speaker with no headphones, one display only, at least 6 Mbps down and 2 Mbps up, and the ability to close every application except OnVUE. Virtual machines, phones, tablets, smart devices with recording or AI features, secondary displays, VPNs, and corporate or public networks are prohibited - and failing the requirements on exam day can mean immediate cancellation and forfeiture of the exam fee.

What the CCFH Attempt Costs

Each CrowdStrike certification exam costs $250 USD, per the program guide. You buy the voucher through your CrowdStrike sales representative or online at Pearson, accept the CrowdStrike Certification Exam Agreement, and must be at least 18 - no exceptions.

Retakes cost the full $250 again and carry mandatory waits: 48 hours after a failed first attempt, seven days for the third and later attempts, and after a fourth performance failure a 30-day wait, retaken recommended training, and a review with the CrowdStrike Certification Manager before a fifth attempt is approved. Retakes beyond the fourth attempt are case-by-case. A failed CCFH is a fee problem and a calendar problem at once - a handled sitting removes both.

Where CCFH Candidates Actually Fail

• •[object Object]
• •[object Object]
• •[object Object]
• •[object Object]

How the Service Works

What You Get

Safety, Risk, and Straight Talk

CrowdStrike's exam guide is direct about misconduct: scores can be invalidated and suspicious action treated as a violation of the Certification Exam Agreement, with exam challenges required within three days. Any provider who pretends those enforcement lines do not exist is not being honest with you.

What we control is the quality, discretion, and privacy of the engagement: an honest feasibility answer before anything starts, a structured execution plan, and a fee that follows the result. If your situation makes the service a bad fit, we tell you before you spend anything.

Candidate Feedback