ExamTopics Logo
Mail Us[email protected]
Menu
Crowdstrike Discussions
exam questions

Exam CCFH-202 All Questions

View all questions & answers for the CCFH-202 exam
Go to Exam

Exam CCFH-202 topic 1 question 44 discussion

Actual exam question from CrowdStrike's CCFH-202
Question #: 44
Topic #: 1
[All CCFH-202 Questions]

In the Powershell Hunt report, what does the “score” signify?

  • A. Number of hosts that ran the PowerShell script
  • B. How recently the PowerShell script executed
  • C. Maliciousness score determined by NGAV
  • D. A cumulative score of the various potential command line switches
Show Suggested Answer Hide Answer
Suggested Answer: D 🗳️
by Chiquitabandita at Sept. 10, 2023, 11:08 p.m.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
alanalanalan
9 months, 2 weeks ago
Answer D D. A cumulative score of the various potential command line switches
upvoted 1 times
...
VasiOnCacao
1 year, 4 months ago
Actually I am for the C here. https://www.crowdstrike.com/blog/tech-center/powershell-hunting/ Listen to what they say about the score field at around the end. Looks more logical to me.
upvoted 1 times
gr23
1 year, 3 months ago
But it doesn't use NGAV to do that. Trick answer. The correct answer is D. Different CLI switches have different ratings ergo different scores. This is in the documentation.
upvoted 1 times
...
...
Jimmy390
1 year, 7 months ago
Selected Answer: D
Checked falcon console, appears to be D
upvoted 2 times
...
Chiquitabandita
1 year, 8 months ago
Selected Answer: D
this one seems most likely and couldnt find info on the other choices
upvoted 1 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago