Which of the following queries will return the parent processes responsible for launching badprogram.exe?
A.
[search (ParentProcess) where name=badprogram.exe ] | table ParentProcessName _time
B.
event_simpleName=processrollup2 [search event_simpleName=processrollup2 FileName=badprogram.exe | rename ParentProcessId_decimal AS TargetProcessId_decimal | fields aid TargetProcessId_decimal] | stats count by FileName _time
C.
[search (ProcessList) where Name=badprogram.exe ] | search ParentProcessName | table ParentProcessName _time
D.
event_simpleName=processrollup2 [search event_simpleName=processrollup2 FileName=badprogram.exe | rename TargetProcessId_decimal AS ParentProcessId_decimal | fields aid TargetProcessId_decimal] | stats count by FileName _time
This query will return the parent processes responsible for launching badprogram.exe by using a
subsearch to find the processrollup2 events where FileName is badprogram.exe, then renaming the
TargetProcessld_decimal field to ParentProcessld_decimal and using it as a filter for the main search,
then using stats to count the occurrences of each FileName by _time.
By renaming TargetProcessld_decimal field to ParentProcessld_decimal, you pivot the targetprocess of badprogram.exe as the child and search for all child process launched by badprogram.exe instead, not the process that spawned badprogram.exe.
query filters for "badprogram.exe" and renames the ParentProcessId_decimal to TargetProcessId_decimal to find the parent processes associated with it. The "stats count by FileName _time" part of the query helps present the results effectively.
This section is not available anymore. Please use the main Exam Page.CCFH-202 Exam Questions
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
alanalanalan
10 months agofive55
1 year, 1 month agogr23
1 year, 4 months agoPipo12345
1 year, 4 months agojoal23
1 year, 7 months agoChiquitabandita
1 year, 8 months agokangaru
1 year, 3 months agoChiquitabandita
1 year, 8 months agoexamtopics3000
1 year, 9 months agoexamtopics3000
1 year, 9 months ago