CCFH-202 Practice Test

CCFH-202 Practice Test practice questions, page 4 of 4, with answer review and explanations.

Question 16

Which of the following queries will return the parent processes responsible for launching badprogram.exe?

  1. [search (ParentProcess) where name=badprogram.exe ] | table ParentProcessName _time
  2. event_simpleName=processrollup2 [search event_simpleName=processrollup2 FileName=badprogram.exe | rename ParentProcessId_decimal AS TargetProcessId_decimal | fields aid TargetProcessId_decimal] | stats count by FileName _time
  3. [search (ProcessList) where Name=badprogram.exe ] | search ParentProcessName | table ParentProcessName _time
  4. event_simpleName=processrollup2 [search event_simpleName=processrollup2 FileName=badprogram.exe | rename TargetProcessId_decimal AS ParentProcessId_decimal | fields aid TargetProcessId_decimal] | stats count by FileName _time

Question 17

You want to produce a list of all event occurrences along with selected fields such as the full path, time, username etc. Which command would be the appropriate choice?

  1. fields
  2. distinctcount
  3. table
  4. values